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Significant  Improvements  Needed  in  DOD's  Efforts  to 
Address  Improper  Payment  and  Recovery  Auditing 
Requirements 


Why  GAO  Did  This  Study 


What  GAO  Found 


The  Department  of  Defense  (DOD) 
is  required,  as  are  other  federal 
executive  agencies,  to  report 
improper  payment  information 
under  the  Improper  Payments 
Information  Act  of  2002  (IPIA)  and 
recovery  auditing  information 
under  section  831  of  the  National 
Defense  Authorization  Act  for 
Fiscal  Year  2002,  commonly  known 
as  the  Recovery  Auditing  Act.  The 
DOD  Office  of  Inspector  General 
has  previously  reported 
deficiencies  at  DOD  related  to 
these  acts  and  GAO’s  prior  work  on 
DOD’s  reporting  of  its  fiscal  year 
2006  travel  improper  payments 
estimate  also  identified 
shortcomings.  Because  of  these 
and  other  long-standing 
weaknesses,  the  subcommittee 
asked  GAO  to  examine  DOD’s 
fiscal  year  2007  improper  payment 
and  recovery  audit  reporting  to 
determine  whether  adequate 
processes  existed  to  address  both 
statutory  requirements.  To 
complete  this  work,  GAO  reviewed 
DOD’s  annual  reports,  conducted 
site  visits,  and  met  with  cognizant 
DOD  officials. 


What  GAO  Recommends 


GAO  made  13  recommendations 
aimed  at  improving  DOD’s  efforts 
to  strengthen  its  improper  payment 
and  recovery  auditing  processes. 
DOD  concurred  with  only  one  of 
our  recommendations  and 
provided  technical  comments 
which  we  incorporated  as 
appropriate.  GAO  continues  to 
believe  the  recommendations  are 
appropriate  to  meet  the  intent  of 
both  acts  and  improve  management 
of  these  key  activities. 

View  GAO-09-442  or  key  components. 

For  more  information,  contact  Kay  L.  Daly  at 
(202)  512-9095  or  dalykl@gao.gov. 


DOD’s  process  for  addressing  IPIA  requirements  had  significant  weaknesses. 
For  example,  as  shown  in  the  figure  below,  DOD  did  not  conduct  risk 
assessments  for  all  of  its  payment  activities  as  $322  billion  in  agency  outlays 
were  excluded  from  the  amounts  assessed.  For  those  payment  activities 
reviewed,  DOD  assessed  the  risk  of  improper  payments  occurring  as  low 
despite  the  department’s  long-standing  financial  management  weaknesses  and 
could  not  provide  documentation  supporting  the  methodologies  used  and  the 
final  risk  level.  GAO  also  found  that  DOD  did  not  estimate  improper  payments 
for  commercial  pay  under  IPIA  requirements,  its  largest  payment  activity. 
Further,  the  Office  of  the  Comptroller’s  oversight  and  monitoring  activities 
were  inadequate  because  they  did  not  include  verifying  the  accuracy  and 
completeness  of  the  information  in  the  agency’s  financial  report  (AFR). 


DOD's  Fiscal  Year  2007  Payment  Population  Subjected  to  the  Risk  Assessment  and 
Estimation  Processes  under  IPIA 


Agency  outlays 

$815  Billion 

Risk  assessments  done 

$493  Billion 

Risk  assessments  not  done 
$322  Billion 

Estimates  done 
for  five  payment 
activities3 

$152.7  Billion 

Estimates  not  done  for  one  payment  1 

activity-commercial  pay 
$340.3  Billion 

Source:  GAO  analysis  of  DOD  fiscal  year  2007  payment  activity  outlays. 

aThe  five  payment  activities  include  civilian  pay,  military  health  benefits,  military  pay,  military 
retirement  pay,  and  travel  pay. 


In  addition  to  not  estimating  improper  payments  for  commercial  pay,  DOD’s 
processes  for  identifying  and  recovering  commercial  overpayments  were 
inadequate,  because  they  were  not  designed  for  this  purpose  as  required  by 
the  Recovery  Auditing  Act.  For  example,  GAO  found  that  contract  closeout 
processes  were  designed  to  ensure  that  applicable  administrative  actions  had 
been  completed  (e.g.,  all  classified  documents  were  disposed  of)  and  not  to 
specifically  identify  contract  overpayments.  DOD  also  lacked  detailed 
guidance  on  how  to  conduct  a  recovery  audit  program  and  did  not  fully 
address  the  recovery  auditing  reporting  requirements  in  its  AFR,  such  as 
disclosing  the  total  cost  associated  with  its  recovery  auditing  activities.  The 
Office  of  the  Comptroller  also  did  not  verify  the  accuracy  and  completeness  of 
the  recovery  audit  information  in  the  AFR,  which  resulted  in  $20.5  billion 
being  excluded  from  its  universe  of  commercial  payments.  DOD  stated  that  its 
processes  were  sufficient  to  address  the  requirements  of  both  acts,  but  since 
then  has  taken  some  actions,  such  as  updating  relevant  guidance.  Until  these 
critical  deficiencies  are  addressed,  DOD  will  be  unable  to  determine  the 
extent  to  which  improper  payments  exist  and  are  subsequently  recovered. 
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GAO 

^^Accountability  *  Integrity  *  Reliability 

United  States  Government  Accountability  Office 
Washington,  DC  20548 


July  29,  2009 

The  Honorable  Thomas  R.  Carper 
Chairman 

The  Honorable  John  McCain 
Ranking  Member 

Subcommittee  on  Federal  Financial  Management, 

Government  Information,  Federal  Services, 
and  International  Security 

Committee  on  Homeland  Security  and  Governmental  Affairs 
United  States  Senate 

The  Honorable  Tom  Coburn,  M.D. 

United  States  Senate 

The  Department  of  Defense  (DOD)  spends  hundreds  of  billions  of  dollars 
on  its  mission  to  defend  the  United  States  from  attack  upon  its  territory 
and  secure  its  interests  abroad.  With  an  annual  appropriation  exceeding 
$500  billion  in  fiscal  year  2009,  and  supplemental  funding  of  about  $77 
billion  for  that  same  year  to  support  overseas  military  operations,  DOD 
has  been  entrusted  with  more  of  the  taxpayers’  dollars  than  any  other 
federal  agency.  Given  its  size  and  mission,  it  is  the  largest  and  most 
complex  organization  to  manage  in  the  world.  As  a  steward  of  taxpayer 
dollars,  DOD  is  accountable  for  how  it  spends  and  safeguards  these  funds 
against  improper  payments1  as  well  as  having  mechanisms  in  place  to 
recoup  those  funds  when  improper  payments  occur. 

DOD  is  required,  as  are  other  executive  agencies,  to  report  improper 
payment  information  under  the  Improper  Payments  Information  Act  (IPIA) 
of  2002. 2  IPIA  requires  executive  agencies,  aided  by  guidance  from  the 
Office  of  Management  and  Budget  (OMB),3  to  annually  identify  programs 


improper  payments  are  defined  as  any  payment  that  should  not  have  been  made  or  that 
was  made  in  an  incorrect  amount  (including  overpayments  and  underpayments)  under 
statutory,  contractual,  administrative,  or  other  legally  applicable  requirements.  It  also 
includes  any  payment  to  an  ineligible  recipient  or  ineligible  service,  duplicate  payments, 
payments  for  services  not  received,  and  any  payment  for  an  incorrect  amount. 

2Pub.  L.  No.  107-300,  116  Stat.  2350  (Nov.  26,  2002). 

Appendix  C  to  OMB  Circular  No.  A-123,  Requirements  for  Effective  Measurement  and 
Remediation  of  Improper  Payments  (Aug.  10,  2006). 
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and  activities  susceptible  to  significant  improper  payments,  estimate 
amounts  improperly  paid  under  those  programs  and  activities,  and  report 
on  the  amounts  improperly  paid  and  their  actions  to  reduce  improper 
payments.4  Similarly,  agencies  are  also  required  to  report  on  their  efforts 
to  recover  overpayments  made  to  contractors  under  section  831  of  the 
National  Defense  Authorization  Act  for  Fiscal  Year  2002,  commonly 
known  as  the  Recovery  Auditing  Act.5  This  act  requires,  among  other 
things,  that  all  executive  branch  agencies  entering  into  contracts  with  a 
total  value  exceeding  $500  million  in  a  fiscal  year  have  cost-effective 
programs  for  identifying  errors  in  paying  contractors  and  for  recovering 
amounts  erroneously  paid.  Since  fiscal  year  2004,  agencies  have  been 
required  by  OMB  to  report  on  IPLA  and  recovery  auditing  efforts  in  their 
performance  and  accountability  reports  (PAR). 

For  years,  we  have  reported  on  long-standing  weaknesses  and  the  lack  of 
adequate  transparency  and  appropriate  accountability  across  DOD’s  major 
business  areas,  resulting  in  billions  of  dollars  of  wasted  resources 
annually.6  In  our  January  2009  High-Risk  Update,1  we  identified  various 
DOD  high-risk  areas,  including  contract  management  (designated  in  1992) 
and  financial  management  (designated  in  1995),  that  make  the  department 
vulnerable  to  improper  payments.  DOD’s  contract  management 
weaknesses,  such  as  ineffective  oversight,  increase  the  risk  that  DOD  will 
pay  more  than  the  value  of  the  goods  delivered  or  services  performed. 
Financial  management  deficiencies  adversely  affected  the  department’s 
ability  to  control  costs;  ensure  basic  accountability;  prevent  and  detect 
fraud,  waste,  and  abuse;  and  represent  a  significant  obstacle  to  achieving 
an  unqualified  opinion  on  the  U.S.  government’s  consolidated  financial 
statements. 


4OMB’s  guidance  defines  significant  improper  payments  as  those  in  any  particular  program 
that  exceed  both  2.5  percent  of  program  payments  and  $10  million  annually.  For  improper 
payment  estimates  exceeding  $10  million,  IPLA  and  OMB  guidance  requires  agencies  to 
develop  action  plans  to  reduce  improper  payments. 

^National  Defense  Authorization  Act  for  Fiscal  Year  2002,  Pub.  L.  No.  107-107,  div.  A,  title 
VIII,  §  831, 115  Stat.  1012,  1186  (Dec.  28,  2001),  codified  at  31  U.S.C.  §§  3561-3567. 

6GAO,  High-Risk  Series:  Defense  Contract  Pricing,  GAO/HR-93-8  (Washington,  D.C.: 
December  1992);  High-Risk  Series,  GAO/HR-95-1  (Washington,  D.C.:  February  1995);  High- 
Risk  Series:  An  Update,  GAO-07-310  (Washington,  D.C.:  January  2007). 

7GAO,  High-Risk  Series:  An  Update,  GAO-09-271  (Washington,  D.C.:  January  2009). 
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Given  DOD’s  size,  complexity,  and  history  of  financial  management 
weaknesses,  you  asked  us  to  examine  DOD’s  fiscal  year  2007  improper 
payment  and  recovery  auditing  reporting — the  most  current  data  available 
at  the  time  of  the  request — to  determine  whether  DOD  had  adequate 
processes  in  place  to  address  IPIA  and  Recovery  Auditing  Act  reporting 
requirements.  To  address  these  objectives,  we  reviewed  applicable 
improper  payment  and  recovery  auditing  legislation,  related  OMB 
guidance,  and  past  GAO  and  DOD  Office  of  Inspector  General  (DOD  OIG) 
reports.  We  also  reviewed  improper  payment  and  recovery  audit 
information  reported  in  DOD’s  agency  financial  report  (AFR)8  for  fiscal 
years  2004  through  2008.  We  obtained  supporting  documentation  and 
performed  independent  assessments,  including  statistical  sampling 
analysis,  to  determine  the  accuracy  and  completeness  of  DOD’s  reported 
fiscal  year  2007  improper  payment  and  recovery  audit  information.  We 
also  inquired  about  any  improvements  and  other  changes  made  in  the 
fiscal  year  2008  improper  payments  and  recovery  auditing  processes. 

We  conducted  site  visits  at  two  Defense  Finance  and  Accounting  Service 
(DFAS)  locations  (DFAS-Kansas  City  and  DFAS-Columbus).9  During  our 
site  visits,  we  conducted  walkthroughs  to  understand  the  process  for 
identifying,  estimating,  and  reporting  improper  payment  estimates  as  well 
as  the  processes  for  identifying  and  recovering  overpayments.  In  addition, 
we  interviewed  knowledgeable  agency  officials  about  their  processes  to 
prevent,  detect,  and  reduce  improper  payments;  recover  and  report 
commercial  overpayments;  and  oversee  and  monitor  these  various  efforts 
at  a  departmentwide  level.  We  obtained  supporting  documentation  and 
performed  independent  assessments,  including  legal  analysis,  to  determine 
the  adequacy  of  the  processes  to  meet  IPIA  and  Recovery  Auditing  Act 
requirements  and  related  OMB  guidance. 


8Prior  to  fiscal  year  2007,  executive  branch  agencies  were  required  to  report  improper 
payment  information  in  their  PAR.  Beginning  with  fiscal  year  2007,  OMB  established  a  pilot 
program  for  the  AFR  in  which  select  agencies  alternatively  presented  their  PAR 
information,  including  improper  payment  and  recovery  audit  information,  in  a  condensed 
format.  DOD  is  one  of  nine  agencies  that  issued  an  AFR  for  fiscal  year  2008. 

9DFAS  is  responsible  for  providing  professional,  financial,  and  accounting  services  to  DOD 
and  other  federal  agencies.  It  delivers  mission-essential  payroll,  contract  and  vendor  pay, 
and  accounting  services.  Five  DFAS  offices — Columbus,  Indianapolis,  Cleveland, 
Limestone,  and  Rome — processed  contract  and  vendor  payments.  DFAS-Columbus 
processes  DOD’s  largest  payment  activity,  commercial  payments.  For  our  period  of  review, 
DFAS-Kansas  City  was  responsible  for  identifying  and  estimating  improper  payments  for 
military  and  civilian  pay.  DFAS-Kansas  City  was  closed  in  July  2008  due  to  a  base 
realignment  and  closure  decision. 
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To  assess  the  reliability  of  data  reported  in  DOD’s  fiscal  year  2007  AFR,  we 
reviewed  DOD’s  supporting  improper  payment  and  recovery  audit 
information  as  well  as  data  from  systems  that  produced  payment 
information,  and  interviewed  knowledgeable  agency  officials  about 
procedures  used  to  assume  the  quality  of  the  data.  We  determined  that  the 
data  were  sufficiently  reliable  for  the  purposes  of  this  report.  We 
conducted  this  performance  audit  from  June  2008  to  July  2009  in 
accordance  with  generally  accepted  government  auditing  standards.10 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives.  See  appendix  I  for  more  details 
on  the  scope  and  methodology. 


Background 


Our  work  over  the  past  several  years  has  demonstrated  that  improper 
payments  are  a  long-standing,  widespread,  and  significant  problem  in  the 
federal  government. 11  In  December  2007,  we  reported  on  DOD’s  fiscal  year 
2006  travel  program  improper  payment  estimates.12  We  found  that  (1)  the 
improper  payment  estimate  was  understated  by  at  least  $4  million, 

(2)  several  weaknesses  in  DOD’s  sampling  methodology  did  not  result  in 
statistically  valid  estimates  of  travel  improper  payments  at  the  component 
level,  and  (3)  limited  guidance  and  oversight  by  the  Office  of  the 


10We  initiated  preliminary  audit  work  under  a  separate  job  code  in  February  2008  and  orally 
briefed  your  subcommittee  on  this  work  in  June  2008. 

nGAO,  DOD  Travel  Cards:  Control  Weaknesses  Led  to  Millions  in  Fraud,  Waste,  and 
Improper  Payments,  GAO-04-825T  (Washington,  D.C.:  June  9,  2004);  Financial 
Management:  Challenges  in  Meeting  Requirements  of  the  Improper  Payments 
Information  Act,  GAO-05-417  (Washington,  D.C.:  Mar.  31,  2005);  Improper  Payments: 
Agencies’  Fiscal  Year  2005  Reporting  Under  the  Improper  Payments  Information  Act 
Remains  Incomplete,  GAO-07-92  (Washington,  D.C.:  Nov.  14,  2006);  Improper  Payments: 
Incomplete  Reporting  under  the  Improper  Payments  Information  Act  Masks  the  Extent  of 
the  Problem.,  GAO-07-254T  (Washington,  D.C.:  Dec.  5,  2006);  Improper  Payments: 

Agencies’  Efforts  to  Address  Improper  Payment  and  Recovery  Auditing  Requirements 
Continue,  GAO-07-635T  (Washington,  D.C.:  Mar.  29,  2007);  Improper  Payments:  Status  of 
Agencies’  Efforts  to  Address  Improper  Payment  and  Recovery  Auditing  Requirements, 
GAO-08-438T  (Washington,  D.C.:  Jan.  31,  2008);  and  Improper  Payments:  Progress  Made 
but  Challenges  Remain  in  Estimating  and  Reducing  Improper  Payments,  GAO-09-628T 
(Washington,  D.C.:  Apr.  22,  2009). 

12GAO,  DOD  Travel  Improper  Payments:  Fiscal  Year  2006  Reporting  Was  Incomplete  and 
Planned  Improvement  Efforts  Face  Challenges,  GAO-08-16  (Washington,  D.C.:  Dec.  14, 
2007). 
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Comptroller  contributed  to  the  unreliable  assessment  of  improper 
payments  for  the  travel  program.  The  DOD  OIG  also  has  issued  reports  for 
the  past  few  years  highlighting  weaknesses  in  the  department’s  efforts  to 
report  on  improper  payment  information. 13  The  DOD  OIG  reported  that  the 
department  had  not  implemented  guidance  to  address  the  use  of  valid 
statistical  sampling  in  determining  programs  and  activities  susceptible  to 
significant  improper  payments.  In  January  2008,  it  reported  that  DFAS  had 
not  conducted  adequate  research  to  determine  if  contractor  refunds  were 
improper  and,  in  some  cases,  had  not  reported  improper  payments 
associated  with  these  refunds. 14  The  DOD  OIG  continues  to  report  that  the 
department  has  not  fully  complied  with  the  requirements  of  IPIA  and 
OMB’s  implementing  guidance  and  does  not  have  adequate  controls  to 
fully  implement  a  recovery  audit  program. 1B 


Overview  of  IPIA,  the 
Recovery  Auditing  Act, 
and  OMB  Implementing 
Guidance 


Guidance  for  reporting  under  IPIA  and  the  Recovery  Auditing  Act  is 
provided  in  Appendix  C  of  OMB  Circular  No.  A-123.  IPIA  requires  agencies 
to  perform  four  key  steps  in  meeting  the  improper  payment  reporting 
requirements  as  shown  in  figure  1. 


13DOD  OIG  Report,  Identification  and  Reporting  of  DOD  Erroneous  Payments ,  D-2005- 
100  (Aug.  17,  2005);  Identification  and  Reporting  of  Improper  Payments  through 
Recovery  Auditing,  D-2007-110  (July  9,  2007);  and  Identification  and  Reporting  of 
Improper  Payments  by  the  Defense  Logistics  Agency,  D-2008-096  (May  20,  2008). 

14DOD  OIG  Report,  Identification  and  Reporting  of  Improper  Payment  Refunds  from 
DOD  Contractors,  D-2008-043  (Jan.  31,  2008). 

15DOD  OIG  Report,  D-2007-110. 
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Figure  1 :  IPIA  Required  Steps  to  Identify,  Estimate,  Reduce,  and  Report  Improper 
Payment  Information 


Improper  Payments  -  Required  Steps 

1.  Perform  risk  assessment 

Annually  review  all  programs  and  activities  to  identify  those 
susceptible  to  significant  improper  payments,  defined  by  OMB  as 
exceeding  $10  million  and  2.5  percent  of  program  payments. 

]  2.  Estimate  improper  payments 

Estimate  improper  payments  for  programs  susceptible  to 
significant  improper  payments. 

]  3.  Implement  a  plan 

Implement  a  plan  to  reduce  improper  payments  for  any  program 
or  activity  exceeding  $10  million  in  estimated  improper  payments. 

]  4.  Annually  report 

Annually  report  improper  payment  estimates  and  actions  to 
reduce  them. 


v _ y 


Source:  GAO. 


OMB’s  implementing  guidance  instructs  agencies  to  carry  out  the  four  key 
steps  under  IPIA,  with  one  exception.  For  the  first  step — perform  a  risk 
assessment — OMB  guidance  allows  agency  programs  deemed  not  risk- 
susceptible  to  conduct  a  risk  assessment  generally  every  3  years.  Further, 
agencies  need  not  conduct  formal  risk  assessments  for  those  programs  in 
which  improper  payment  baselines  are  already  established,  are  in  the 
process  of  being  measured,  or  will  be  measured  by  an  established  date. 
However,  OMB  guidance  does  state  that  if  a  program  experiences  a 
significant  change  in  legislation,  a  significant  increase  in  funding  level,  or 
both,  agencies  are  required  to  reassess  the  program’s  risk  susceptibility 
during  the  next  annual  cycle,  even  if  it  is  less  than  3  years  from  the  last 
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assessment.  As  we  have  previously  testified  before  your  Subcommittee16 
this  is  inconsistent  with  the  express  terms  of  IPLA,  which  require  that 
agencies  annually  review  all  of  their  programs  and  activities. 

OMB  then  requires  that  agencies  estimate  the  gross  total  of  both  over-  and 
underpayments  for  those  programs  and  activities  identified  as  susceptible. 
These  estimates  shall  be  based  on  a  statistically  random  sample  of 
sufficient  size  to  yield  an  estimate  with  a  90  percent  confidence  interval  of 
plus  or  minus  2.5  percentage  points.  If  an  agency  cannot  determine 
whether  a  payment  was  proper  because  of  insufficient  documentation, 
Appendix  C  to  OMB  Circular  No.  A-123  requires  that  the  payment  be 
considered  improper.  The  guidance  further  requires  that  agencies  develop 
corrective  action  plans  that  include  a  discussion  of  the  causes  of  the 
improper  payments  identified,  corrective  actions  taken  for  each  different 
type  or  cause  of  error,  and  the  results  of  actions  taken  to  address  those 
causes.  In  addition,  OMB  Circular  No.  A-136,  Financial  Reporting 
Requirements  requires  agencies  to  report,  in  table  format,  improper 
payment  estimates  and  related  outlay  amounts  for  the  prior  year,  current 
year,  and  the  following  3  years.  As  part  of  this  reporting,  OMB  encourages 
agencies  to  report  underpayment  and  overpayment  amounts,  if  available. 

The  Recovery  Auditing  Act  requires  each  executive  branch  agency  that 
annually  enters  into  contracts  with  a  total  value  of  $500  million  or  more  to 
use  recovery  audits  and  recovery  activities  as  part  of  a  cost-effective 
recovery  auditing  program.  The  law  authorizes  federal  agencies  to  retain 
recovered  funds  to  cover  actual  administrative  expenses  as  well  as  to  pay 
other  contractors,  such  as  collection  agencies.  OMB  guidance  requires, 
among  other  things,  that  agencies  include  in  their  annual  reporting  a 
general  description  and  evaluation  of  the  steps  taken  to  carry  out  a 
recovery  auditing  program,  the  total  amount  of  contracts  subject  to 
review,  the  actual  amount  of  contracts  reviewed,  the  amounts  identified 
for  recovery,  and  the  amounts  actually  recovered  in  a  current  year. 
Further,  OMB  Circular  No.  A-136  requires  agencies  to  report  cumulative 
amounts  identified  for  recovery  and  amounts  actually  recovered  as  a  part 
of  their  current  year  reporting. 


16  GAO,  Improper  Payments:  Status  of  Agencies’  Efforts  to  Address  Improper  Payment 
and  Recovery  Auditing  Requirements,  GAO-08-438T  (Washington,  D.C.:  Jan.  31,  2008). 
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Organizational 
Responsibility  for  IPIA 
Reporting  at  the 
Department  of  Defense 


The  responsibility  for  assessing  and  reporting  DOD’s  improper  payments 
information  rests  with  the  Office  of  the  Under  Secretary  of  Defense 
(Comptroller)  (Office  of  the  Comptroller).  The  Accounting  and  Finance 
Policy  Directorate  within  the  Office  of  the  Comptroller  is  responsible  for 
carrying  out  the  day-to-day  activities  involved  in  meeting  IPIA 
requirements.  To  collect  improper  payment  information  including  risk 
assessments,  improper  payment  estimates,  and  corrective  actions,  the 
Accounting  and  Finance  Policy  Directorate  sends  out  an  improper 
payment  survey  (IPIA  survey)17  to  all  DOD  agencies  and  military  services 
requesting  improper  payment  information  for  the  current  fiscal  year  (see 
app.  II  for  a  list  of  the  33  agencies  and  military  services).18  The  agencies 
and  services  are  required  to  submit  improper  payment  estimates  to  the 
Accounting  and  Finance  Policy  Directorate  for  all  DOD  payment  activities 
identified  under  IPIA.  The  Accounting  and  Finance  Policy  Directorate  then 
aggregates  and  reports  the  improper  payment  information  in  DOD’s  annual 
AFR. 

Since  implementation  of  IPIA,  DOD  has  reported  improper  payment 
estimates  for  the  following  payment  activities  for  fiscal  years  2004-2008  as 
shown  in  table  1  below. 


11  The  IPIA  annual  survey  requires  agencies  and  military  services  to  perform  a  risk 
assessment  of  all  programs  and  activities  that  may  be  susceptible  to  erroneous  payments 
and  to  report  improper  payment  information.  The  agency  and  military  services’ 
submissions  are  to  be  based  on  fiscal  year  disbursements,  and  identify  both  the  gross  totals 
of  overpayments  and  underpayments  and  the  methodology  used  to  estimate  improper 
payments. 

18For  fiscal  year  2007,  the  Accounting  and  Finance  Policy  Directorate  distributed  the  survey 
to  33  entities.  Of  the  33  entities,  22  reported  that  they  did  not  process  payments  for  fiscal 
year  2007  and  deferred  to  their  applicable  payment  processing  center  responsible  for 
conducting  the  risk  assessment.  The  remaining  11  entities  either  processed  their  own 
payments  or  were  DOD  payment  processing  centers.  Only  9  of  those  1 1  DOD  entities 
reported  conducting  risk  assessments  for  one  or  more  of  the  six  payment  activities 
reviewed  under  IPIA. 
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Table  1 :  Fiscal  Years  2004-2008  Improper  Payment  Estimates 


(dollars  in  millions) 

Payment  activity 

2004 

2005 

2006 

2007 

2008 

Civilian  paya 

Not  reported6 

Not  reported6 

$16.7 

$74.6 

$73.9 

Commercial  pay 

Not  reported6 

Not  reported6 

$550.0 

Not  reported6 

Not  reported6 

Military  health  benefits 

$99.6 

$87.8 

$83.5 

$88.6 

$178.0 

Military  pay3 

Not  reported6 

$432.0 

$65.9 

$416.4 

$434.6 

Military  retirement 

$66.0 

$49.3 

$49.4 

$48.7 

$44.0 

Travel  pay 

Not  reported6 

Not  reported6 

$29.4 

$43.6 

$103.0 

Totals 

$165.6 

$569.1 

$794.9 

$671.9 

$833.5 

Source:  GAO  analysis  of  DOD’s  fiscal  years  2004  through  2008  PARs  or  AFRs. 

beginning  in  fiscal  year  2007,  military  and  civilian  improper  payments  included  estimated  and  actual 
amounts. 

bDOD  did  not  report  improper  payment  estimates  for  these  payment  activities  because  it  determined 
that  they  were  not  susceptible  to  significant  improper  payments. 

“DOD  changed  its  approach,  which  resulted  in  its  not  calculating  an  estimate  for  improper  payments 
for  this  payment  activity.  Instead,  DOD  decided  to  annually  report  actual  overpayments  discovered 
via  its  recovery  auditing  program. 


Organizational 
Responsibility  for 
Recovery  Auditing 
Reporting  at  the 
Department  of  Defense 


Similarly  to  improper  payment  reporting,  the  Office  of  the  Comptroller  is 
responsible  for  identifying  and  annually  reporting  recovery  audit 
information  in  DOD’s  AFR,  while  its  Accounting  and  Finance  Policy 
Directorate  is  responsible  for  carrying  out  the  day-to-day  activities.  DOD’s 
recovery  auditing  process  over  contract  and  vendor  payments 
(commercial  payments)  encompasses  several  organizations  including 
DFAS  offices  and  external  contractors,  which  are  discussed  later  in  this 
report.19  These  organizations  are  required  to  compile  and  submit  the 
universe  of  commercial  payments,  commercial  overpayments  identified 
for  recovery,  and  commercial  payments  actually  recovered  to  the 
Accounting  and  Finance  Policy  Directorate.  It  in  turn  aggregates  and 
reports  the  recovery  audit  information  in  DOD’s  annual  AFR.  DOD’s 
reported  recovery  audit  information  for  fiscal  years  2004-2008  is  shown  in 
table  2  below. 


19Contract  payments  include  disbursements  for  complex,  multiyear  purchases  with  high 
dollar  amounts,  such  as  weapon  systems.  Vendor  payments  include  purchases  for  day-to- 
day  goods  and  services,  such  as  food,  fuel,  and  transportation. 
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Table  2:  Recovery  Audit  Results  for  Fiscal  Years  2004  through  2008 

(amounts  in  millions) 

Fiscal  year 

Agency-reported 
amount  subject  to  review 
for  fiscal  year  reporting 

Agency-reported 
actual  amount  reviewed 
and  reported  in  fiscal  year 

Agency-reported 
overpayments  identified 
for  recovery  in  fiscal  year 

Agency-reported 
amount  recovered 
in  fiscal  year 

2004a 

Not  reported0 

Not  reported0 

Not  reported0 

$6.3 

2005a 

$  222,800.0 

$  222,800.0 

$469.5° 

$414.9° 

2006a 

$299,400.0 

$  299,400.0 

$170.0 

$133.3 

2007°' 0 

$  189,300.0 

$  189,300.0 

$24.6 

$19.6 

2008d 

$331,192.0 

$331,192.0 

$53.3 

$41.7 

Source:  GAO  analysis  of  DOD’s  fiscal  years  2004  through  2008  PARs  or  AFRs. 

“Prior  to  fiscal  year  2007,  DOD  generally  reported  recovery  audit  amounts  resulting  from  contractor- 
identified  and  DOD-identified  overpayments. 

bFor  fiscal  year  2004,  OMB  did  not  require  agencies  to  report  on  this  information  as  part  of  their 
recovery  auditing  reporting. 

'In  fiscal  year  2005,  the  amount  identified  for  recovery  includes  both  underpayments  (67  percent)  and 
overpayments  (33  percent).  Also,  the  amounts  recovered  include  both  recouped  amounts  and 
disbursements  for  underpayments. 

'Beginning  in  July  2007,  DOD  excluded  contractor-identified  vendor  overpayments  from  its  recovery 
audit  reporting  since  these  overpayments  did  not  result  from  DOD’s  recovery  auditing  efforts. 

“In  fiscal  year  2007,  DOD  excluded  vendor  payments  from  its  recovery  audit  reporting. 


Significant 
Weaknesses  Existed 
in  DOD’s  Efforts  to 
Address  IPLA 
Requirements 


DOD’s  processes  to  conduct  risk  assessments,  estimate  improper 
payments,  and  develop  corrective  actions  to  reduce  improper  payments 
for  its  fiscal  year  2007  IPLA.  reporting  had  significant  weaknesses.  A  lack  of 
detailed  guidance  as  well  as  inadequate  monitoring  and  oversight  of  DOD’s 
improper  payment  activities  also  existed,  raising  doubts  about  the 
accuracy  of  the  information  reported. 


Risk  Assessment  Process, 
Guidance,  and 
Documentation  Need 
Improvements 


DOD’s  risk  assessment  process  was  inadequate  to  ensure  that  appropriate 
consideration  was  given  to  the  risks  associated  with  its  payment  activities, 
thus  not  allowing  management  appropriate  visibility  of  its  vulnerabilities. 
DOD  lacked  detailed  guidance  on  how  to  conduct  a  risk  assessment, 
including  identifying  the  universe  of  activities,  determining  if  risks  exist, 
identifying  what  those  risks  are,  and  evaluating  the  results,  as  required  by 
our  internal  control  standards.20  Recognizing  that  the  internal  guidance 


20GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1. 
(Washington,  D.C.:  November  1999). 
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and  documentation  needed  to  be  improved,  in  December  2008,  DOD 
issued  a  new  Financial  Management  Regulation  (FMR)  chapter — Volume 
4,  Chapter  14,  Improper  Payments — to  expand  existing  guidance  to 
address  IPIA  requirements,  by  clarifying  the  agencies’  and  military 
services’  responsibilities  for  reporting  improper  payment  information, 
broken  down  by  payment  activity.  Although  we  did  not  determine  the 
adequacy  of  these  changes  as  the  scope  of  our  audit  was  fiscal  year  2007, 
we  noted  that  DOD  did  not  require  its  agencies  and  military  services  to 
document  their  risk  methodologies,  including  risk  factors  considered,  the 
potential  or  actual  impact  on  their  program  operations,  and  the  rationale 
for  assessing  risk  as  either  low,  medium,  or  high. 

While  nine  DOD  components  conducted  risk  assessments  for  their  six 
payment  activities  totaling  about  $493  billion  in  fiscal  year  2007, 21  we 
found  an  additional  $322  billion  in  outlays  reported  in  DOD’s  Statement  of 
Budgetary  Resources  (SBR)  that  had  not  been  assessed22  although  IPIA 
requires  that  agencies  annually  review  all  programs  and  activities  (see  fig. 
2).  According  to  Office  of  the  Comptroller  officials,  the  six  payment 
activities  it  assessed  covered  all  DOD  outlays  for  fiscal  year  2007  and  the 
$322  billion  difference  in  outlays  represented  IPIA  reporting  differences 
related  to  payroll  payments  for  three  of  its  six  payment  activities  (net 
outlays  reported  for  IPIA  purposes  versus  gross  outlays  reported  for  SBR 
purposes),  intragovernmental  payments,  and  payments  resulting  from 
classified  activities.  While  DOD  officials  stated  that  it  reconciled  the  $322 
billion  difference  to  the  SBR  (with  the  exception  of  classified  activities), 
these  officials  did  not  provide  us  with  this  reconciliation  to  enable  us  to 
independently  substantiate  this  difference.  Further,  these  officials  could 
not  reconcile  the  $493  billion  in  outlays  for  the  six  payment  activities  to  an 
alternative  source,  such  as  the  SBR.  Based  on  this  comparison,  DOD  had 
not  reviewed  all  of  its  programs  and  activities.  Office  of  the  Comptroller 
officials  told  us  that  DOD  agencies  and  the  military  services  were  required 
to  reconcile  their  payment  activities  with  their  budget  data  for  fiscal  year 


21The  nine  components  were  the  Departments  of  the  Army,  the  Navy,  and  the  Air  Force;  the 
United  States  Marine  Corps;  the  Defense  Finance  and  Accounting  Service;  the  Defense 
Security  Service;  the  National  Geospatial  Intelligence  Agency;  the  United  States  Army 
Corps  of  Engineers;  and  the  TRICARE  Management  Activity.  These  components  reported 
on  one  or  more  of  the  following  six  payment  activities:  civilian  pay,  commercial  pay, 
military  health  benefits,  military  pay,  military  retirement  pay,  and  travel  pay. 

22DOD’s  Statement  of  Budgetary  Resources  for  fiscal  year  2007  reported  gross  outlays  of 
about  $815  billion.  The  Statement  of  Budgetary  Resources  is  prepared  independently  from 
the  DOD  office  responsible  for  addressing  IPIA  requirements. 
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2008  to  ensure  that  all  payment  activities  had  been  accounted  for  at  the 
component  level. 


Figure  2:  DOD’s  Fiscal  Year  2007  Payment  Population  Subjected  to  the  Risk 
Assessment  Process  under  IPIA 


Agency  outlays 

$815  Billion 


Risk  assessments  done 

1 

Risk  assessments  not  done  i 

$493  Billion 

$322  Billion  1 

i 

Source:  GAO  analysis  of  DOD  fiscal  year  2007  payment  activity  outlays. 


In  addition,  DOD  did  not  have  sufficient  documentation  to  support  the 
level  of  assessed  risk  for  the  six  payment  activities  it  did  evaluate  as 
required  by  OMB  guidance  and  our  internal  control  standards.23  For 
example,  none  of  the  nine  components  that  conducted  risk  assessments 
described  their  methodology  or  rationale  for  the  level  of  risk  assigned  to 
each  applicable  payment  activity.  For  the  six  risk  assessments  conducted, 
DOD  had  determined  the  risk  of  having  significant  improper  payments  was 
low,  based  on  OMB  criteria.  However,  given  the  lack  of  supporting 
documentation  and  evidence  for  the  risk  assessments  and  DOD’s  history 
of  long-standing  weaknesses,  including  GAO’s  designation  of  eight 
individual  DOD  areas  as  high  risk,24  the  low  risk  levels  are  not  based  on 
sufficient  analysis  and  are  likely  unrealistic  and  not  reflective  of  the  wide 
range  of  vulnerabilities  that  exist  within  DOD.  Office  of  the  Comptroller 
officials  told  us  that  the  department  calculates  improper  payment 
estimates  for  the  majority  of  the  payment  activities  under  IPIA,  regardless 
of  risk  level  assessed  in  determination  of  susceptibility  to  significant 
improper  payments,  because  of  the  large  volume  and  high  dollar  amounts 
of  the  transactions.  DOD  did  not  rely  on  the  results  of  the  risk  assessments 
to  determine  whether  to  address  the  remaining  IPIA  requirements. 
Although  DOD  did  not  rely  on  its  risk  assessments,  the  implementation  of 
IPIA  requires  agencies  to  make  decisions  as  to  how  to  proceed  based  on 
the  completion  of  risk  assessments,  which  is  the  first  step.  Therefore, 
DOD’s  failure  to  conduct  adequate  risk  assessments  could  negatively 


23Appendix  C  to  OMB  Circular  No.  A-123,  pt.  1(E);  GAO/AIMD-OO-21.3.1. 
Z4GAO-09-271. 
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impact  its  ability  to  gain  the  information  it  needs  to  make  decisions  as  it 
proceeds  through  the  remaining  steps  to  ensure  proper  implementation  of 
IPIA  requirements. 

As  we  previously  reported,  the  information  developed  during  a  risk 
assessment  forms  the  foundation  or  basis  upon  which  management  can 
determine  the  nature  and  type  of  corrective  actions  needed.25  It  also  gives 
management  baseline  information  for  measuring  progress  in  reducing 
improper  payments.  Until  the  department  recognizes  the  importance  of 
performing  comprehensive  risk  assessments,  the  reported  information  will 
not  provide  meaningful  results  or  adequately  depict  DOD’s  risk  of 
improper  payments,  thus  not  providing  the  level  of  transparency 
envisioned  by  IPIA. 


Improper  Payment 
Estimate  Was  Not 
Developed  for  DOD’s 
Largest  Payment  Activity 


DOD  had  neither  established  a  methodology  to  estimate  nor  had  it 
estimated  the  amount  of  improper  payments  for  commercial  pay — its 
largest  payment  activity  with  total  outlays  of  $340.3  billion  (see  fig.  3). 
While  DOD,  in  general,  developed  statistically  valid  sampling 
methodologies  and  estimated  improper  payment  amounts  for  its  remaining 
five  payment  activities,26  collectively  the  proportion  of  these  five  payment 
activities  to  DOD’s  reported  payment  population  subject  to  IPIA  was  about 
one-third  of  the  total.  See  appendix  III  for  a  description  of  the  sampling 
plans  for  DOD’s  five  payment  activities.  OMB  guidance  requires  that  for 
any  programs  and  activities  identified  as  susceptible  to  significant 
improper  payments,  agencies  must  develop  a  statistically  valid 
methodology  to  estimate  the  annual  amount  of  improper  payments, 
including  a  gross  total  of  both  under-  and  overpayments.  Although  DOD 
assessed  all  six  payment  activities  to  be  at  low  risk  for  improper 


2BGAO-07-92. 

26For  the  military  health  benefits  payment  activity,  the  confidence  level  TRICARE 
Management  Agency  used  to  test  the  denied  claims  component  was  80  percent,  instead  of 
the  90  percent  confidence  level  required  by  OMB  guidance.  However,  we  determined  that 
the  impact  of  this  deviation  was  immaterial.  For  the  travel  payment  activity,  DFAS 
performed  a  duplicate  review  for  one  of  its  component  systems,  the  Integrated  Automated 
Travel  System.  We  previously  reported  that  these  duplicate  reviews  could  not  be  used  to 
estimate  the  value  of  improper  payments  to  the  entire  population.  We  recommended,  and 
DOD  agreed,  to  establish  and  implement  procedures  to  report  a  valid  improper  payment 
estimate  for  the  population.  See  GAO,  DOD  Travel  Improper  Payments:  Fiscal  Year  2006 
Reporting  Was  Incomplete  and  Planned  Improvement  Efforts  Face  Challenges,  GAO-08-16 
(Washington,  D.C.:  Dec.  14,  2007).  We  determined  that  for  fiscal  year  2008,  DFAS  had 
developed  a  statistically  valid  methodology  for  the  travel  payment  activity. 
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payments,  it  chose  to  develop  improper  payment  estimates  for  five  of  the 
six  payment  activities  based  on  the  large  volume  or  high  dollar  amounts  of 
the  transactions.  However,  DOD  did  not  estimate  improper  payments  for 
commercial  pay  despite  the  large  volume  and  high  dollar  amounts  of  the 
transactions. 


Figure  3:  DOD’s  Fiscal  Year  2007  Payment  Population  Subjected  to  the  Risk 
Assessment  and  Estimation  Processes  under  IPIA 


Agency  outlays 

$815  Billion 


Risk  assessments  done 

1 

Risk  assessments  not  done  i 

$493  Billion 

$322  Billion  1 

i 

Estimates  done 
for  five  payment 
activities3 
$152.7  Billion 


Estimates  not  done 
for  one  payment  activity- 
commercial  pay 

$340.3  Billion 


i 

i 

i 

i 


Source:  GAO  analysis  of  DOD  fiscal  year  2007  payment  activity  outlays. 

The  five  payment  activities  include  civilian  pay,  military  health  benefits,  military  pay,  military 
retirement  pay,  and  travel  pay. 


According  to  DOD  officials,  the  department  decided  not  to  establish  a 
statistically  valid  methodology  or  calculate  an  estimate  for  commercial 
improper  payments  under  IPIA  because  (1)  its  past  attempts  to  estimate 
commercial  improper  payments  had  resulted  in  improper  payment 
estimates  that  were  lower  than  the  actual  amount  of  overpayments 
identified,  and  (2)  it  would  create  duplicate  reporting  of  improper 
commercial  payments  as  this  type  of  information  was  captured  as  part  of 
DOD’s  efforts  to  address  Recovery  Auditing  Act  requirements,  which  DOD 
officials  believed  resulted  in  a  better  measurement  because  it  represented 
actual  overpayments.  However,  in  fiscal  year  2006,  DOD  estimated  $550 
million  in  improper  payments,  which  was  nearly  30  percent  higher  than 
the  $426  million  of  actual  under-  and  overpayment  amounts  reported  to 
address  Recovery  Auditing  Act  requirements. 

Regarding  DOD’s  point  that  reporting  commercial  improper  payments 
under  IPIA  and  the  Recovery  Auditing  Act  would  create  duplicate 
reporting,  we  disagree.  DOD  could  leverage  the  results  from  its  existing 
Recovery  Auditing  Act  processes  used  to  identify  actual  commercial 
under-  and  overpayments  to  develop  its  statistical  sampling  methodology 
to  enhance  the  reported  estimate.  This  approach  is  similar  to  DOD’s 
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existing  statistical  sampling  methodologies,  which  also  include  actual 
amounts  for  calculating  improper  payment  estimates  of  civilian  and 
military  pay.  As  we  previously  reported,  the  scope  of  review  under  IPLA 
differs  from  that  of  the  Recovery  Auditing  Act.27  Specifically,  the  scope  of 
review  under  the  Recovery  Auditing  Act  targets  agency-identified  contract 
overpayments,28  whereas  the  scope  of  review  under  IPLA  targets  both 
under-  and  overpayments,  including  agency-  and  contractor-identified 
improper  payments.  Further,  while  OMB  guidance  allows  agencies  to 
exclude  certain  classes  of  contracts  from  their  recovery  auditing  reporting, 
no  such  exclusions  exist  for  IPIA.29 

Establishing  a  well-designed  statistical  sampling  methodology  to  estimate 
DOD’s  improper  commercial  payments  would  not  only  facilitate 
compliance  with  IPIA  requirements,  but  also  help  address  a  current  data 
void  on  the  extent  of  improper  payments  made  to  contractors  and 
vendors.  For  example,  based  on  our  review  of  DOD’s  fiscal  year  2007  data 
of  commercial  payment  errors,  we  identified  $62  million  in  commercial 
improper  payments  and  another  $92  million  of  potential  improper 
payments,  which  were  not  identified  by  DOD’s  current  Recovery  Auditing 
Act  processes.30 

DCAA  and  the  DOD  OIG  also  identified  payment  errors  not  captured  by 
DOD.  For  example,  in  August  2007,  DCAA  reported  that  a  contractor  had 
overbilled — and  DOD  had  overpaid — award  fees31  totaling  about  $267 


27GAO-08-77. 

28Appendix  C  to  OMB  Circular  No.  A-123,  pt.  II  (D)(2). 

29Examples  of  classes  of  contracts  that  OMB  allows  agencies  to  exclude  from  recovery 
auditing  activities  include  cost-type  contracts  that  have  not  been  completed  and  whose 
payments  are  subject  to  further  adjustment  by  the  government  and  cost-type  contracts  that 
have  been  completed  and  subjected  to  a  final  contract  audit. 

30The  $62  million  comprised  various  types  of  contractor-caused  overpayments,  including 
payments  of  duplicate  invoices,  invoice  amounts  with  errors,  and  payments  made  to  the 
wrong  contractor  due  to  errors  in  how  the  contractor  entered  its  information.  DFAS 
officials  told  us  that  these  payment  errors  are  not  considered  improper  payments  because 
the  errors  were  not  made  or  caused  by  DFAS.  This  distinction  based  on  the  source  of  the 
error  is  not  supported  by  IPIA  or  OMB  guidance.  The  $92  million  of  potential  improper 
payments  included  payments  made  by  DFAS  prior  to  the  receipt  of  a  contract  modification 
and  payments  subject  to  court  rulings  and  other  legal  settlements. 

31An  award  fee  is  an  amount  that  the  contractor  may  earn,  in  whole  or  in  part,  during 
contract  performance  that  is  sufficient  to  provide  motivation  for  excellence  in  such  areas 
as  quality,  timeliness,  and  cost-effective  management. 
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million.32  Because  DOD  had  not  established  a  methodology  to  estimate 
improper  payments  for  its  commercial  payment  activity,  these  and  other 
types  of  payment  errors  that  meet  the  definition  of  improper  payments 
were  not  reported,  and  thus,  lacked  the  level  of  transparency  and 
accountability  called  for  under  IPIA.  Further,  without  an  across-the-board, 
systematic  estimate  of  the  extent  of  improper  commercial  payments,  DOD 
management  could  not  determine  (1)  if  improper  commercial  payments 
were  significant  enough  to  require  corrective  actions,  (2)  how  much 
investment  in  new  internal  controls  would  be  cost-justified,  or  (3)  the 
effectiveness  of  any  prior  corrective  actions. 


Corrective  Actions  Not  Although  DOD  reported  the  corrective  actions  taken  or  planned  to  reduce 

Always  Linked  to  Causes  improper  payments  for  its  five  payment  activities  that  met  its  reporting 

threshold,  the  corrective  actions  for  three  of  the  five  payment  activities — 
military  pay,  civilian  pay,  and  travel  pay — generally  did  not  address  the 
root  causes  of  the  improper  payments.  For  travel  pay,  we  found  that  with 
the  exception  of  one  agency  component,  root  causes  had  not  been 
reported  in  DOD’s  AFR,  even  though  a  description  of  the  corrective 
actions  taken  had  been  disclosed.  OMB  guidance  requires  that,  for  all 
programs  and  activities  with  estimated  improper  payments  exceeding  $10 
million,  agencies  must  report  on  the  root  causes  of  the  improper  payments 
identified,  actions  taken  to  prevent  or  reduce  those  root  causes,  and  the 
results  of  actions  taken. 

For  example,  DOD  reported  that  inaccurate  or  untimely  reporting  of 
entitlement  data  on  such  areas  as  time  and  attendance,  personnel  actions, 
and  pay  allowances  was  the  primary  cause  for  the  improper  payments  for 
military  and  civilian  pay.  As  actions  to  address  these  causes,  DOD 
reported  that  it  had  developed  performance  metrics  and  goals  to  track  the 
timeliness  and  accuracy  of  payments  and  that  senior  leadership  had 
participated  in  quarterly  meetings  to  discuss  problem  areas  and  find 
solutions  to  mitigate  the  risk  of  improper  payments.  While  these  actions 
measured  entitlement  performance,  focused  attention  on  the  effectiveness 
of  existing  processes,  and  facilitated  the  sharing  of  information,  it  was 


32DCAA,  Report  on  Evaluation  of  Over  Payments  and  Associated  Interest,  Audit  Report 
No.  3711-2007A17900011  (Aug.  31,  2007).  DCAA  performed  an  audit  after  the  contractor 
notified  DCMA  and  DCAA  of  potential  duplicate  billing  errors.  These  payment  errors 
occurred  over  a  5-year  period  from  July  2002  through  July  2007.  Subsequently  the 
contractor  reimbursed  DOD  for  the  $267  million  through  an  offset  against  a  current  invoice 
that  DOD  had  not  yet  paid  and  wrote  the  government  a  check  for  $28  million  in  interest. 
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unclear  how  these  specific  actions  would  address  the  root  causes  that  led 
to  inaccurate  or  untimely  reporting  and  whether  those  actions  would 
reduce  improper  payments.  Conversely,  for  travel  pay,  we  found  that 
except  for  the  U.S.  Army  Corps  of  Engineers,  DOD  agencies  and  military 
services  did  not  report  the  associated  root  causes  contributing  to 
improper  travel  payments,  even  though  corrective  actions  were  disclosed 
in  the  AFR.  The  U.S.  Army  Corps  of  Engineers  reported  that  the  primary 
causes  of  improper  travel  payments  included  traveler  input  errors  and 
inadequate  supervisory  review  of  travel  vouchers. 

The  Office  of  the  Comptroller  told  us  that  the  root  causes  and  corrective 
actions  implemented  or  underway  were  not  fully  disclosed  in  the  AFR  due 
to  report  formatting  constraints,  preventing  the  inclusion  of  all  detailed 
information.  However,  when  we  reviewed  the  underlying  support,  we 
found  that  this  documentation  also  lacked  details  as  to  (1)  the  corrective 
actions  taken  or  planned  and  generally  mirrored  the  corrective  actions 
reported  in  the  DOD’s  AFR,  (2)  the  root  causes  for  improper  travel 
payments,  and  (3)  the  results,  if  any,  of  the  corrective  actions  taken. 
Accurately  characterizing  and  publicly  reporting  the  root  causes  and 
associated  corrective  actions  to  reduce  improper  payments  enables 
agencies  and  others  with  oversight  and  monitoring  responsibilities  to 
measure  progress  over  time  and  determine  whether  further  action  is 
needed  to  minimize  future  improper  payments,  thus  enhancing 
accountability  over  the  reduction  of  improper  payments  by  ensuring  that 
effective  corrective  actions  are  taken. 

Inadequate  Monitoring  and 
Oversight  of  DOD’s  Improper 
Payment  Activities 


The  Office  of  the  Comptroller’s  monitoring  and  oversight  of  DOD’s 
improper  payment  activities  were  inadequate  because  they  did  not  include 
verifying  the  accuracy  and  completeness  of  the  information  reported  in 
DOD’s  AFR  as  required  by  DOD  guidance.  Specifically,  the  Office  of  the 
Comptroller  issued  a  memorandum  in  November  2006  that  required  the 
Project  Officer  for  Improper  Payments  and  Recovery  Auditing  to,  among 
other  things,  verify  that  DOD’s  reported  information  was  accurate, 
complete,  and  meets  or  exceeds  the  minimum  OMB  reporting 
requirements.  In  addition,  our  internal  control  standards  for  monitoring 
provide  that  processes  should  generally  be  designed  to  ensure  that 
ongoing  monitoring  occurs  in  the  course  of  normal  operations  and  include 
regular  management  and  supervisory  activities,  comparisons,  and 
reconciliations.  Further,  our  internal  control  standards  provide  that 
controls  should  include  a  wide  range  of  diverse  activities  including 


Page  17 


GAO-09-442  DOD  Improper  Payments 


verification  of  information  and  be  aimed  at  validating  the  propriety  and 
integrity  of  both  organizational  and  individual  performance  measures  and 
indicators.33 

During  our  review  and  analysis  of  DOD  agencies’  and  services’  IPIA  survey 
responses,  we  found  that  the  project  officer  had  not  conducted  adequate 
follow-up  to  ensure  that  (1)  the  information  provided  was  accurate  and 
complete  and  sufficient  to  support  risk  assessment  conclusions,  and  (2) 
reported  corrective  actions  planned  or  underway  addressed  the  root 
causes  of  the  improper  payments.  For  example,  DOD  agencies  and  military 
services  did  not  provide  supporting  documentation  for  their  risk 
assessment  methodologies  and  conclusions,  including  the  risk  factors 
considered  as  part  of  this  assessment  and  how  they  arrived  at  the  final 
determination  of  risk  for  applicable  payment  activities.  Yet  we  found  no 
evidence  that  the  Office  of  the  Comptroller  conducted  appropriate  follow¬ 
up  as  part  of  its  oversight  and  monitoring  responsibilities  to  ensure 
payment  activities  had  been  consistently  assessed  and  provided  some  level 
of  comparability  among  DOD  agencies  and  military  services.  We 
previously  reported  on  similar  instances  of  lack  of  oversight  and  review  by 
the  Office  of  the  Comptroller  over  IPIA  reporting  for  DOD’s  travel 
payment  activity.34  In  that  report,  we  found  that  the  IPIA  survey  excluded 
about  $5.1  billion  in  the  universe  of  travel  payments  for  fiscal  year  2006 
and  that  only  $824  million  of  the  total  travel  payments  had  been  reported 
in  DOD’s  annual  report  for  the  same  period.  We  noted  that  these 
discrepancies  would  have  been  brought  to  management’s  attention  in  a 
timely  manner  if  monitoring  activities,  such  as  periodic  reconciliations  and 
comparisons,  had  been  performed. 

Office  of  the  Comptroller  officials  told  us  that  the  DOD  agencies  and  the 
military  services  performed  verification  reviews  prior  to  submission  of 
their  improper  payment  information,  providing  assurances  that  the 
reported  information  was  accurate  and  complete.  As  a  result,  they  did  not 
believe  it  was  necessary  for  the  project  officer  to  independently  validate 
this  information  despite  the  requirement  in  the  November  2006 
memorandum  to  do  so.  However,  based  on  our  findings  discussed  earlier 
in  this  report,  the  oversight  and  monitoring  activities  performed  by  the 
agencies  and  services,  as  well  as  the  Office  of  the  Comptroller,  were 
inadequate.  Without  adequate  monitoring  and  oversight,  DOD  is  at  risk  of 


33GAO/AIMD-00-21.3. 1. 
34GAO-08-16. 
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inaccurately  reporting  the  extent  of  its  improper  payments,  not  taking  the 
steps  needed  to  reduce  improper  payments,  and  ultimately  not  meeting 
IPIA  requirements. 


Much  Work  Remains 
at  DOD  to  Effectively 
Address  the  Recovery 
Auditing  Act 
Requirements 


DOD’s  recovery  audit  program35  was  inadequate  because  it  leveraged 
existing  processes  that  were  not  specifically  designed  to  identify  and 
recover  overpayments  as  stipulated  in  the  Recovery  Auditing  Act.  Further, 
DOD’s  internal  guidance  lacked  detailed  instructions  to  effectively  address 
recovery  auditing  requirements.  We  also  found  that  DOD’s  reported 
recovery  audit  information  for  fiscal  year  2007  was  unreliable,  as  the 
reported  amounts  were  incomplete  and  not  fully  supported.  In  addition, 
we  determined  that  DOD’s  monitoring  and  oversight  activities  were 
inadequate  to  ensure  the  accuracy  and  completeness  of  the  reported 
recovery  audit  information. 


Processes  and  Guidance 
Were  Inadequate  to 
Effectively  Implement 
Recovery  Auditing 
Requirements 


The  majority  of  DOD’s  processes  used  to  identify  and  recover  commercial 
(contractor  and  vendor)  overpayments  were  inadequate  because  they 
were  not  specifically  designed  to  do  so  as  required  by  OMB  guidance  (see 
table  3  for  these  processes).  Specifically,  only  DFAS’s  Internal  Review  and 
DOD’s  two  external  recovery  audits  were  specifically  designed  to  identify 
and  recover  commercial  overpayments.36  We  also  found  that  DFAS 
suspended  its  Internal  Review  postpayment  audit  of  contract  payments — 
its  largest  payment  activity — for  fiscal  year  2007,  but  did  not  disclose  this 
limitation  in  its  fiscal  year  2007  AFR.  DFAS  officials  told  us  that  its 
Internal  Review  contract  postpayment  audits  were  suspended  and  that 
there  was  a  reallocation  of  staff  resources  to  support  base  realignment  and 


3  OMB  defines  a  recovery  audit  program  as  an  agency’s  overall  plan  for  the  performance  of 
recovery  audits  and  recovery  activities.  The  head  of  the  agency  will  determine  the  manner 
and  combination  of  recovery  audits  and  activities  that  are  expected  to  yield  the  most  cost- 
effective  recovery  audit  program  for  the  agency. 

36See  Appendix  C.  to  OMB  Circular  No.  A-123,  pt.  II.  OMB  guidance  identifies  the  following 
types  of  overpayments  or  payment  errors  that  a  recovery  audit  should  target:  duplicate 
payments;  errors  on  invoices  or  financing  requests;  failure  to  reduce  payments  by 
applicable  sales  discounts,  cash  discounts,  rebates,  or  other  allowances;  payments  for 
items  not  received;  mathematical  or  other  errors  in  determining  payment  amounts  and 
executing  payments;  and  failure  to  obtain  credit  for  returned  merchandise. 
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closure  (BRAC)  initiatives,37  specifically  auditing  the  records  of  affected 
DFAS  sites  that  processed  commercial  payments  from  2006  through  2008. 
According  to  DFAS  officials,  to  compensate  for  this  suspension,  DOD 
relied  on  existing  prepayment  controls  to  identify  contract  overpayments, 
such  as  daily  manual  reviews  of  a  random  sample  of  invoices  with 
thresholds  of  $500,000  or  more.  In  January  2009,  Internal  Review  officials 
informed  us  that  the  office  had  reinstituted  efforts  to  conduct  audits  of 
contract  payments.  Internal  Review’s  current  audit  covers  the  “catch  up” 
period  of  payments  made  between  April  2006  and  March  2008,  and  the 
audit  results  are  expected  by  the  end  of  fiscal  year  2009. 


3  BRAC  is  the  process  DOD  has  used  to  reorganize  its  installation  infrastructure  to  more 
efficiently  and  effectively  support  its  forces,  increase  operational  readiness,  and  facilitate 
new  ways  of  doing  business.  According  to  DFAS,  its  largest  vendor  pay  systems  reviewed 
as  part  of  the  BRAC  examination  include  Commercial  Accounts  Payable  System-Windows 
(CAPS-W),  Commercial  Accounts  Payable  System-Clipper  (CAPS-Clipper),  Standard 
Accounting  and  Reporting  System-One  Pay  (One  Pay),  and  Integrated  Accounts  Payable 
System  (TAPS). 
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Table  3:  DOD’s  Key  Postpayment  Processes  to  Identify  Commercial  Overpayments  for  Recovery  in  Fiscal  Year  2007 

DOD  internal  postpayment  process 

Component 

Process 

Description  of  process 

Designed 
to  identify 
commercial 
overpayments 
for  recovery 
(Yes/No) 

DFAS 

Office  of  Internal  Review 
audits  of  commercial 
payments 

Internal  Review  has  a  nonstatutory  audit  function  and  is 
responsible  for  conducting  postpayment  audits  of  commercial 
pay  (contract  and  vendor  payments)  to  identify  and  detect 
erroneous  payments.  It  applies  detective  software  logic  against 
the  contract  and  vendor  payments  data.  Internal  Review  audits 
DOD’s  contract  payment  system,  the  Mechanization  of  Contract 
Administration  Services  (MOCAS)  as  well  as  DOD's  four  largest 
vendor  pay  systems.  For  MOCAS,  prior  to  BRAC,  Internal 

Review  received  the  complete  universe  of  all  payments  on  a 
monthly  basis  and  ran  the  data  mining  logic.  For  the  vendor  pay 
systems,  prior  to  BRAC,  Internal  Review  applied  a  threshold 
between  $200  and  $500  dollars  to  its  payment  universe  and 
then  ran  the  erroneous  payment  detection  logic. 

Yes 

Contract  reconciliations 

Contract  reconciliations  involve  reconstructing  a  contract  to 
determine  the  source  and  reason  for  an  error  or  discrepancy, 
including  comparing  data  among  the  contract,  disbursement, 
and  accounting  records.  These  reconciliations  are  generally 
performed  at  the  request  of  the  contractor,  vendor,  or  DCMA. 

No 

DCMA  and  DCAA 

DCAA  interim  and  final 
voucher  reviews 

For  contractors  enrolled  in  the  direct  billing  program,  whereby 
the  contractor  submits  vouchers  for  payment  without  prior 
review,  DCAA  performs  an  annual,  cursory  review  of  a 
nonstatistical  selection  of  paid  vouchers.  If  a  contractor  is  not 
enrolled  in  the  direct  billing  program,  DCAA  is  required  to 
review  and  approve  contractor  interim  vouchers  for  payment 
and  suspend  payment  of  questionable  costs.  DCAA  is  required 
to  review  final  vouchers  and  send  them  to  the  administrative 
contracting  officer.  [Contract  Audit  Manual  (CAM)  6-1007.6; 

FAR  §  42.803;  DFARS  §  242.803;  DFARS  §  242.803(b)(i)(B); 
DODD  5105.36,  paras.  5.4  and  5.5;  and  DOD  FMR  vol.  10,  ch. 
10,  para.  100202] 

No 

DCAA  incurred  cost  audits 

DCAA  determines  allowability  of  the  contractors'  claimed  costs 
incurred  and  submitted  by  contractors  for  reimbursement  under 
cost-reimbursable,  fixed-price  incentive,  and  other  types  of 
flexibly  priced  contracts  and  compliance  with  contract  terms, 
FAR,  and  CAS,  if  applicable.  [FAR  §§  42.1 01 , 42.803(b),  and 
DFARS  §  242.803] 

No 

DCMA  and  DCAA  contract 
closeout  process 

The  closeout  process  is  conducted  at  the  end  of  a  contract  and 
involves  multiple  steps.  For  example,  DCAA  reviews  final 
completion  vouchers  and  the  cumulative  allowable  cost 
worksheet  and  may  review  a  contract  closing  statement. 

[DFARS  §  242.803(b)(i)(D);  CAM  6-71 1 .3(a)  and  (d);  CAM  6- 
708.2(d)] 

No 
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DOD  internal  postpayment  process 

Component 

Process 

Description  of  process 

Designed 
to  identify 
commercial 
overpayments 
for  recovery 
(Yes/No) 

DOD  external  recovery  audits 

TRICARE 
Management 
Activity  (TMA)a 

TMA  Recovery  Audit 

TMA  hired  a  recovery  audit  contractor  to  identify  overpayments 
made  to  hospitals  for  medical  services  provided  to  DOD 
beneficiaries.  The  contractor  specialized  in  identifying 
overpayments  to  hospitals  that  failed  to  submit  amended  cost 
reports. 

Yes 

Navyb 

Navy  Telecommunications 
Recovery  Audit 

Navy  hired  a  recovery  audit  contractor  to  identify  overpayments 
made  in  its  telecommunications  program. 

Yes 

Source:  GAO’s  analysis. 


Although  the  contract  was  terminated  in  February  2007,  overpayments  were  still  collected  in  fiscal 
year  2007.  The  contractor  identified  about  $30  million  in  overpayments  for  the  period  of  1 992  through 
1997,  of  which  $27  million  had  been  collected  as  of  fiscal  year  2008,  including  $700,000  in  fiscal  year 
2007.  DCAA  assumed  responsibility  for  this  process  after  the  contract  was  terminated  and  recently 
identified  $6  million  in  overpayments  for  the  period  of  1998  through  2004.  Flowever,  no  amounts  have 
yet  been  recovered. 

"The  contractor  encountered  problems  during  the  audit  with  data  access  and  quality,  which 
contributed  to  the  difficulty  in  identifying  and  recovering  improper  payments.  Although  the  Navy 
projected  savings  of  approximately  21  percent  from  the  recovery  audit,  no  improper  payments  were 
recovered  through  this  effort.  In  2007,  DOD  OIG  reported  that  other  recovery  audit  contractors 
experienced  instances  of  data  access  issues  and  recommended  that  DOD  remove  impediments 
caused  by  proprietary  records,  and  allow  timely  access  to  data.  DOD  did  not  concur  with  this 
recommendation. 


According  to  DOD  officials,  the  existing  processes  were  adequately 
designed  to  fulfill  the  requirements  of  the  Recovery  Auditing  Act  and  OMB 
guidance  and  thus,  no  further  actions  were  needed.  However,  we  found 
the  majority  of  the  existing  processes  were  not  specifically  designed  to 
identify  overpayments.  For  example,  DFAS’s  contract  reconciliations  were 
performed  upon  request  to  resolve  previously  identified  discrepancies, 
including  possible  overpayments,  within  DOD’s  contract,  disbursement, 
and  accounting  records  such  as  to  correct  funding  classification  or  lines  of 
accounting  errors.  Because  a  contract  reconciliation  would  be  performed 
only  if  an  error  related  to  a  specific  contract  was  found,  contracts  and  the 
associated  disbursements  that  did  not  have  identified  errors  would  not  be 
subject  to  this  review.  As  a  result,  this  process  was  not  intended  to  identify 
new,  undetected  contract  overpayments  as  envisioned  by  the  Recovery 
Auditing  Act.  In  addition,  we  noted  that  DCMA’s  and  DCAA’s  contract 
closeout  processes  were  designed  to  ensure  that  applicable  administrative 
actions  had  been  completed  during  the  course  of  a  contract  (e.g.,  all 
classified  documents  were  disposed  of)  and  not  to  specifically  identify 
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contract  overpayments.  The  DOD  OIG  has  reported  instances  where  the 
department  was  unable  to  reconcile  and  close  out  contracts  due  to  missing 
documentation  and  staff  turnover.38  Further,  although  DOD  considered 
DCAA  contract  audits  an  integral  part  of  its  recovery  audit  program,  DCAA 
officials  pointed  out  that  because  recovery  auditing  is  a  review  of  DOD 
components’  books  and  records,  DCAA  would  generally  have  no  role  since 
its  audits  primarily  focus  on  contractors’  records.39 

Moreover,  based  on  our  review,  DOD’s  internal  guidance  did  not  identify 
the  applicable  payment  and  accounting  systems  to  be  reviewed,  the 
frequency  of  this  review,  and  the  applicable  roles  and  responsibilities  at 
DFAS  and  the  military  services  processing  commercial  payments, 
including  coordination  of  these  efforts.  We  found  no  discussion  on  how 
DOD  would  leverage  existing  audits  to  identify  commercial  overpayments 
performed  at  military  service  audit  agencies,  such  as  the  Army  Audit 
Agency.  Further,  the  guidance  did  not  include  specific  actions  that 
addressed  OMB’s  recovery  auditing  reporting  requirements,  including 
actions  to  develop  a  corrective  action  plan  to  address  the  root  causes  of 
payment  errors  and  steps  to  measure  the  total  cost  of  the  agency’s 
recovery  auditing  program.  In  fiscal  year  2009,  DOD  acknowledged  the 
need  to  clarify  and  update  its  guidance  and  has  efforts  underway  to  revise 
the  recovery  auditing  chapter. 

DOD  further  reported  in  its  fiscal  year  2007  AFR  that  it  had  actions 
underway  to  implement  a  Business  Activity  Monitoring  (BAM)  service  to 
provide  a  real-time  or  near  real-time  automated  mechanism  for  analyzing 
transactions  to  prevent  and  reduce  the  risk  of  duplicate  payments  and 
other  types  of  errors.  DFAS  believes  this  new  process  will  reduce  the  need 
for  internal  postpayment  reviews  of  commercial  payments  by  identifying 
errors  before  payment  occurs.  DFAS  anticipates  DOD-wide 
implementation  of  BAM  during  fiscal  year  2009.  Until  the  department 
establishes  processes  specifically  designed  to  address  recovery  auditing 


38DOD  OIG  Reports,  Financial  Management  Contracts  Classified  as  Unreconcilable  by 
the  Defense  Finance  and  Accounting  Service  Columbus  Contract  NO.  F30602-81-C-0153, 
D-2005-040  (Mar.  14,  2005)  and  Financial  Management  Contracts  Classified  as 
Unreconcilable  by  the  Defense  Finance  and  Accounting  Service  Columbus  Contract 
DCAA09-81  -G-2008/0031,  D-2005-047  (Apr.  1,  2005). 

39We  note  that  DCAA’s  voucher  reviews  and  incurred  cost  audits  might  find  some  payments 
that  are  overpayments  under  the  Recoveiy  Auditing  Act  such  as  payments  that  are 
unallowable  because  they  are  duplicates.  However,  DCAA’s  work  is  not  designed  to  detect 
all  overpayments  under  the  Recovery  Auditing  Act. 
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and  updates  its  internal  guidance,  it  will  be  unable  to  determine  the  extent 
to  which  contract  overpayments  exist  and  are  subsequently  recovered  to 
fulfill  the  Recovery  Auditing  Act  requirements. 


DOD  Reported  Recovery 
Audit  Information  for 
Fiscal  Year  2007  Was 
Incomplete 


DOD  did  not  fully  address  OMB  recovery  auditing  reporting  requirements 
in  its  AFR,  such  as  disclosing  the  total  costs  associated  with  its  recovery 
auditing  activities  and  the  associated  recovered  amounts  related  to 
overpayments  made  to  vendors.  DOD’s  guidance  did  not  include  the 
specific  recovery  auditing  reporting  requirements  identified  in  OMB’s 
guidance.  The  following  describes  the  status  of  DOD’s  actions  on  each  of 
the  nine  reporting  elements  under  OMB’s  recovery  auditing  reporting 
requirements: 


•  A  general  description  and  evaluation  of  the  steps  taken  to  carry 
out  a  recovery  auditing  program. 

•  DOD  reported  a  general  description  of  the  steps  taken  to 
implement  its  recovery  auditing  program,  but  did  not 
provide  an  evaluation. 

•  The  total  cost  of  the  agency’s  recovery  auditing  program. 

•  DOD  informed  us  that  it  did  not  report  total  costs  because 
it  was  unable  to  calculate  the  amount.  DOD  officials  told  us 
that  the  agency  did  not  have  cost  accountants  and  thus 
lacked  the  expertise  needed  to  calculate  the  total  cost  of 
the  agency’s  recovery  auditing  program,  particularly  the 
costs  of  the  agency’s  internal  recovery  efforts  (agency 
salaries  and  expenses). 

•  The  total  amount  of  contracts  subject  to  review. 

•  DOD  did  not  report  the  full  amount  subject  to  review. 
Specifically,  DOD  excluded  from  its  AFR  $20.5  billion  of  its 
commercial  payment  universe  for  fiscal  year  2007. 
According  to  Office  of  the  Comptroller  officials,  it  did  not 
include  $20.5  billion  for  the  U.S.  Army  Corps  of  Engineers 
and  Army  Europe  in  the  universe  of  commercial  payments 
because  of  an  oversight  error.  The  $20.5  billion  represents 
commercial  payments  processed  by  Army  Europe  and  the 
U.S.  Army  Corps  of  Engineers.  If  the  $20.5  billion  amount 
had  been  included,  the  total  universe  of  reported 
commercial  payments  would  have  increased  to  $340.3 
billion. 

•  The  actual  amount  of  contracts  reviewed. 

•  As  stated  above,  DOD  excluded  $20.5  billion  from  the  full 
amount  actually  reviewed  because  of  an  oversight  error. 
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•  The  amounts  identified  for  recovery. 

•  DOD  reported  the  overpayments  identified  for  recovery  for 
contractors,  but  not  for  vendors.  DFAS  officials  told  us  that 
they  did  not  report  for  vendor  payments  the  amounts 
identified  for  recovery  and  actually  recovered  because  the 
department  did  not  have  a  process  to  separate  and  quantify 
DOD-identified  vendor  overpayments  from  contractor- 
identified  vendor  overpayments.  In  July  2007,  DFAS 
introduced  an  automated  process — the  Contractor  Debt 
System  (CDS) — to  track  DOD-identified  overpayments  to 
vendors,  but  CDS  was  not  fully  deployed  by  the  time  DOD 
issued  its  fiscal  year  2007  AFR.40 

•  The  amounts  actually  recovered  in  the  current  year. 

•  DOD  reported  the  associated  recovered  amounts  for 
contractor  overpayments,  but  did  not  report  similar 
information  for  vendors.  As  stated  above,  DOD  did  not 
report  this  information  because  it  lacked  the  processes 
needed  to  distinguish  between  DOD-identified  and 
contractor-identified  vendor  overpayments. 

•  A  corrective  action  plan  to  address  the  root  causes  of  payment 
errors. 

•  DOD  did  not  report  on  its  corrective  action  plan  to  address 
the  root  causes  of  payment  errors.  We  requested — but  DOD 
did  not  provide — its  corrective  action  plan  to  reduce 
commercial  overpayments. 

•  A  general  description  and  evaluation  of  any  management 
improvement  program  carried  out  as  part  of  its  recovery 
auditing  program. 

•  DOD  reported  a  general  description  of  an  initiative — 
Business  Activity  Monitoring  service — it  planned  to 
implement  to  reduce  overpayments.  However,  DOD  did  not 
report  a  general  evaluation  of  this  initiative,  because  it  had 
not  been  implemented. 

•  A  description  and  justification  of  the  classes  of  contracts 
excluded  from  recovery  auditing  review  by  the  agency  head. 

•  This  reporting  element  is  not  applicable  as  DOD  officials 
told  us  that  the  department  reviewed  all  classes  of 
contracts  as  part  of  its  recovery  auditing  program. 


40CDS  is  a  debt  collection  and  reporting  system  used  by  the  DFAS-Columbus  Debt 
Management  Office  to  track  new  and  existing  contractor  debt  owed  to  the  government. 
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DOD  also  could  not  substantiate  the  reported  $18.9  million  of  DFAS 
recovered  contract  overpayments  for  fiscal  year  2007,  because  it  did  not 
maintain  the  underlying  documentation  that  supported  the  amount.  DOD 
was  unable  to  recreate  the  documentation  because  the  system  data 
reflected  real-time  information  and  changed  daily.  Although  the  Office  of 
the  Comptroller  reported  commercial  overpayment  data  for  the  Navy  for 
fiscal  year  2008,  it  did  not  do  so  for  fiscal  year  2007  and  was  unable  to 
confirm  whether  it  should  have  reported  comparable  data  for  that  period. 
Office  of  the  Comptroller  officials  told  us  that  they  did  not  follow  up  with 
the  Navy  to  determine  why  it  did  not  report  recovery  audit  information  for 
fiscal  year  2007.  Our  internal  control  standards  related  to  control  activities 
state  that  all  transactions  and  other  significant  events  need  to  be  clearly 
documented  and  should  be  readily  available  for  examination,  and  that 
documentation  and  records  should  be  properly  managed  and  maintained.41 
Until  DOD  reports  the  required  information  and  ensures  the  accuracy  of 
the  information  it  does  report,  the  extent  to  which  Congress,  OMB,  and 
other  oversight  bodies  can  rely  on  this  information  to  make  informed 
decisions  is  questionable. 


Inadequate  Monitoring  and 
Oversight  of  DOD’s 
Recovery  Auditing 
Activities 


The  Office  of  the  Comptroller’s  oversight  and  monitoring  of  DOD’s 
recovery  auditing  activities  were  inadequate  as  they  indicated  that  they 
had  not  verified  the  accuracy  and  completeness  of  the  information 
reported  in  DOD’s  AFR.  These  activities  were  generally  limited  to 
compiling  data  received  from  DOD  agencies  and  the  military  services  and 
performing  a  fluctuation  analysis  of  these  data  to  identify  changes  in 
amounts  between  the  current  and  prior  year.  We  found  that  the  roles  and 
responsibilities  for  the  Recovery  Auditing  Project  Officer,  who  was  tasked 
with  overseeing  DOD’s  recovery  auditing  efforts,  were  not  documented  in 
the  November  2006  memorandum  from  the  Office  of  the  Comptroller 
establishing  the  position.42  In  addition,  the  project  officer  devoted  minimal 
time — about  10  percent  for  fiscal  year  2007 — to  overseeing  DOD’s 
recovery  auditing  efforts,  and  frequent  turnover  occurred  with  this 
position.  Between  fiscal  years  2007  and  2008  we  noted  that  four  different 


41GAO/AIMD-00-21.3. 1. 

420n  July  10,  2009,  DOD  informed  us  that  the  roles  and  responsibilities  of  the  Recovery 
Auditing  Project  Officer  would  be  included  in  its  revised  chapter  in  the  DOD  Financial 
Management  Regulation,  Volume  10,  Chapter  22,  “Recovery  Auditing”.  DOD  anticipates 
that  the  updated  chapter  will  be  published  by  the  end  of  the  fiscal  year  2009. 
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people  had  been  assigned  to  oversee  DOD’s  recovery  auditing  program.43 
Our  internal  control  standards  for  monitoring  provide  that  processes 
should  generally  be  designed  to  ensure  that  ongoing  monitoring  occurs  in 
the  course  of  normal  operations  and  include  regular  management  and 
supervisory  activities,  comparisons,  and  reconciliations.  Further,  our 
internal  control  standards  provide  that  controls  should  include  a  wide 
range  of  diverse  activities  including  verification  of  information  and  be 
aimed  at  validating  the  propriety  and  integrity  of  both  organizational  and 
individual  performance  measures  and  indicators.44  Also,  excessive 
turnover  could  significantly  impact  the  department’s  ability  to  sustain  the 
knowledge,  skills,  and  experience  needed  to  effectively  oversee 
implementation  of  the  Recovery  Auditing  Act  requirements. 

Office  of  the  Comptroller  officials  acknowledged  that  the  recovery  audit 
data  submitted  by  the  DOD  agencies  and  military  services  were  not 
independently  validated  to  ensure  that  the  information  was  accurate, 
complete,  and  met  the  minimum  reporting  requirements.  In  December 
2007,  DOD  established  a  recovery  auditing  working  group  comprised  of 
representatives  from  the  DOD  agencies  and  military  service  components 
to  identify  best  practices  for  recovery  auditing;  however,  this  group  has 
yet  to  meet.  At  the  DOD  component  level,  we  were  informed  that  Navy,  on 
its  own  initiative,  established  a  working  group  in  fiscal  year  2008  to 
identify  and  recover  commercial  overpayments  and  report  this 
information  to  the  Office  of  the  Comptroller.  Without  adequate  monitoring 
and  oversight,  the  department  does  not  have  adequate  assurance  that  its 
future  reporting  under  the  Recovery  Auditing  Act  will  be  accurate  and 
complete. 


43For  fiscal  year  2007,  the  Project  Officer  for  Improper  Payments  and  Recovery  Auditing 
had  dual  responsibility  for  overseeing  DOD’s  improper  payment  and  recovery  auditing 
activities.  In  November  2007,  DOD  established  the  Recovery  Auditing  Project  Officer 
position  to  oversee  DOD’s  recovery  audit  program.  The  Office  of  the  Comptroller  informed 
us  that  the  Recovery  Auditing  Project  Officer  estimated  that  up  to  25  percent  of  her  time 
was  devoted  to  overseeing  recovery  auditing  activities,  as  this  was  an  added  responsibility 
to  other  duties  she  was  assigned  in  the  Office  of  the  Comptroller.  From  March  2008  to 
August  2008,  due  to  staff  turnover,  DOD  reverted  back  to  one  person  who  had  dual 
improper  payment  and  recovery  auditing  responsibilities.  For  this  time  period,  the  Project 
Officer  for  Improper  Payments  and  Recovery  Auditing  told  us  that  she  devoted  only  10 
percent  of  her  time  to  overseeing  recovery  auditing  activities.  Again,  in  September  2008, 
the  Office  of  the  Comptroller  filled  the  Recovery  Auditing  Project  Officer  position  and  that 
person  devoted  between  35-40  percent  of  her  time  to  overseeing  recovery  auditing 
activities  at  DOD. 

44GAO/AIMD-00-2 1.3.1. 
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Conclusions 


DOD  has  not  established  the  mechanisms — processes  and  detailed 
implementing  guidance — needed  to  effectively  implement  the 
requirements  for  both  IPIA  and  the  Recovery  Auditing  Act.  The 
department  reports  that  its  payment  activities  are  at  low  risk  for  improper 
payments  without  adequate  supporting  analysis  and  documentation  and 
despite  its  history  of  long-standing  financial  management  weaknesses. 
Because  addressing  IPIA  requirements  is  a  sequential  process,  DOD’s 
failure  to  conduct  comprehensive  risk  assessments,  which  is  the  first  step, 
has  adversely  affected  decisions  made  to  address  subsequent  steps  in  the 
process.  DOD  has  not  accurately  portrayed  the  full  extent  of  improper 
payments  or  the  associated  root  causes.  As  a  result,  any  corrective  actions 
taken  are  likely  to  fall  short  of  fixing  the  problems  that  resulted  in  these 
errors.  With  regard  to  recovery  efforts,  DOD  continues  to  rely  on 
processes  that  are  inadequate  for  identifying  the  extent  of  overpayments 
to  contractors  and  vendors  and  ensuring  that  these  amounts  are 
recovered.  Until  the  department  takes  definitive  action  to  fulfill  the 
requirements  of  these  acts  and  implement  preventive  internal  controls,  it 
is  at  risk  of  making  improper  payments  and  wasting  taxpayer  funds. 


Recommendations  for  ™f)rove  DOD’s  efforts  to  address  improper  payment  and  recovery 

auditing  requirements,  we  recommend  that  the  Secretary  of  Defense  direct 
Executive  Action  the  DOD  Comptroller  to  take  the  following  13  actions. 

For  IPIA,  the  DOD  Comptroller  should 

•  Establish  and  implement  a  systematic  approach,  as  a  part  of  the  risk 
assessment  process,  to  ensure  all  programs  and  activities  are  reviewed 
to  determine  susceptibility  to  improper  payments. 

•  Develop  and  implement  detailed  guidance  for  conducting  risk 
assessments,  including  the  steps  to  determine  if  risk  exists,  what  those 
risks  are,  and  the  potential  or  actual  impact  of  those  risks  on  program 
operations. 

•  Require  DOD  agencies  and  the  military  services  to  document  the  risk 
assessment  methodology  used,  including  the  risk  factors  considered, 
and  the  rationale  for  assessing  the  risk  level  for  the  payment  activity. 

•  Develop  and  implement  a  statistically  valid  methodology  to  estimate 
and  report  commercial  improper  payments  (contract  and  vendor  over- 
and  underpayments).  This  methodology  should  include  all  payment 
errors  regardless  of  the  source  of  the  error — DOD,  contractors,  or 
vendors — as  required  by  IPIA. 

•  Identify  and  fully  disclose  the  root  causes  of  improper  payments 
annually  in  the  AFR. 
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•  Identify  and  fully  disclose  the  corrective  actions,  and  monitor  the 
corrective  actions  to  ensure  that  they  address  applicable  root  causes. 

•  Perform  oversight  and  monitoring  activities  to  ensure  the  accuracy  and 
completeness  of  the  improper  payment  data  submitted  by  the  DOD 
agencies  and  the  military  services  for  inclusion  in  the  AFR. 

For  Recovery  Auditing  Act,  the  DOD  Comptroller  should 

•  Establish  and  implement  processes  specifically  designed  to  identify 
and  recover  commercial  overpayments. 

•  Develop  and  implement  detailed  guidance  to  assist  DOD  agencies  and 
the  military  services  in  effectively  carrying  out  recovery  audits  and 
activities,  including  the  payment  and  accounting  systems  to  be 
reviewed,  the  frequency  of  these  reviews,  applicable  roles  and 
responsibilities,  and  reporting  requirements. 

•  Establish  and  implement  a  process  to  identify  costs  related  to  the 
department’s  recovery  auditing  program,  including  costs  for 
employees’  salaries. 

•  Establish  and  implement  a  process  to  identify  and  report  vendor 
overpayments  and  the  associated  recovered  amounts. 

•  Maintain  documentation  to  support  the  amounts  reported  in  the  AFR 
to  allow  for  independent  evaluation  of  this  information. 

•  Perform  oversight  and  monitoring  activities  to  ensure  the  accuracy  and 
completeness  of  the  recovery  auditing  data  submitted  by  the  DOD 
agencies  and  the  military  services  for  inclusion  in  the  AFR.  Also, 
document  the  roles  and  responsibilities  of  the  Recovery  Auditing 
Project  Officer. 


Agency  Comments 
and  Our  Evaluation 


DOD  provided  written  comments  on  a  draft  of  this  report  which  are 
reprinted  in  their  entirety  in  appendix  IV.  DOD  also  provided  technical 
comments  that  we  have  incorporated  as  appropriate.  In  its  written 
comments,  DOD  disagreed  with  all  but  1  of  our  13  recommendations 
designed  to  strengthen  its  improper  payment  and  recovery  auditing 
processes.  DOD  stated  that  generally  the  actions  envisioned  by  our 
recommendations  were  already  being  accomplished  within  the  department 
or  were  not  required  by  OMB  and  thus,  such  direction  from  GAO  was  not 
necessary.  We  disagree.  While  DOD  presently  has  efforts  underway,  as 
noted  in  this  report,  it  has  not  yet  established  the  processes  and  detailed 
guidance  for  effectively  implementing  either  IPLA  or  the  Recovery  Auditing 
Act.  In  its  comments,  DOD  did  not  provide  any  new  evidence  that  was  not 
considered  in  our  report.  Accordingly,  we  continue  to  believe  that  our 
recommendations  are  critical  for  DOD  to  enhance  its  efforts  to  minimize 
improper  payments  and  recover  those  that  are  made.  The  following 
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paragraphs  illustrate  the  nature  of  DOD’s  comments  and  our  analysis  of  its 
key  points. 


DOD’s  Processes  To 
Address  IPIA 
Requirements 


DOD  disagreed  with  our  three  recommendations  aimed  at  enhancing 
DOD’s  risk  assessment  processes.  We  recommended  the  DOD  Comptroller 
require  DOD  agencies  and  the  military  services  to  establish  and  implement 
risk  assessment  methodologies,  along  with  documentation  of  key  factors 
considered  and  the  rationale  for  assessing  the  risk  level  for  the  payment 
activity.  DOD  stated  that  such  direction  was  not  necessary  as  it  had 
established  IPIA  program  baselines  and  measures  and  reports  on  all  of  its 
IPIA  programs  annually  in  accordance  with  OMB  guidance.  As  described 
in  our  report,  DOD’s  risk  assessment  process  was  inadequate  to  ensure 
that  appropriate  consideration  was  given  to  the  risks  associated  with  its 
payment  activities  as  we  found  an  additional  $322  billion  in  DOD  outlays 
that  had  not  been  assessed  under  IPIA.  For  payment  activities  assessed, 
DOD  did  not  require  its  agencies  and  military  services  to  document  their 
risk  methodologies,  including  risk  factors  considered,  the  potential  or 
actual  impact  on  their  program  operations,  and  the  rationale  for  assessing 
risk  as  either  low,  medium,  or  high.  As  such,  none  of  the  nine  DOD 
components  that  conducted  risk  assessments  described  their  methodology 
or  rationale  for  the  low  level  of  risk  assigned  to  each  applicable  payment 
activity.  Given  the  lack  of  supporting  documentation  and  evidence  for  the 
risk  assessments  as  well  as  DOD’s  history  of  long-standing  internal  control 
weaknesses,  including  GAO’s  prior  designation  of  eight  functional  DOD 
areas  as  high  risk,  the  low  risk  levels  are  not  based  on  sufficient  analysis, 
are  likely  unrealistic,  and  are  not  reflective  of  the  wide  range  of 
vulnerabilities  that  exist  within  DOD. 

DOD  also  disagreed  with  our  recommendation  that  it  develop  and 
implement  a  statistically  valid  methodology  to  estimate  and  report 
commercial  improper  payments  (contract  and  vendor  over-  and 
underpayments).  DOD  stated  that  it  has  followed  guidance  provided  by 
OMB  and  that  commercial  improper  payments  are  to  be  identified, 
recovered  and  reported  in  accordance  with  the  Recovery  Auditing  Act.  As 
described  in  our  report,  DOD  stated  that  reporting  improper  commercial 
payments  under  IPIA  would  create  duplicate  reporting  because  this 
information  was  captured  as  part  of  DOD’s  efforts  to  address  Recovery 
Auditing  Act  requirements.  However,  we  disagree  because  those  actions 
are  not  sufficient  to  address  IPIA.  Both  acts  must  be  addressed  with 
regard  to  commercial  payment  activity.  Each  act  has  a  different  scope  of 
review  and  reporting  requirements.  Based  on  the  improper  payment 
definition  under  IPIA  and  OMB’s  guidance  that  instructs  agencies  to 
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develop  a  statistically  valid  estimate,  the  statistical  sampling  requirement 
would  apply  to  commercial  payments  under  IPIA.  Developing  an  across- 
the-board,  systematic  estimate  of  the  extent  of  improper  payments  gives 
management  baseline  information  for  measuring  progress  in  reducing 
improper  payments  and  how  much  investment  in  new  internal  controls 
would  be  cost-justified. 

DOD  disagreed  with  our  two  recommendations  to  identify  and  fully 
disclose  in  the  AFR  the  root  causes  of  improper  payments  and  the 
corrective  actions,  including  monitoring  those  actions  to  ensure  that  they 
address  applicable  root  causes.  DOD  commented  that  the  AFR  was  not  the 
appropriate  forum  for  this  detailed  level  information  and  that  it  had 
procedures  in  place  to  identify,  fully  disclose,  and  monitor  corrections.  We 
have  two  main  concerns  with  DOD’s  responses  to  these  recommendations. 
First,  DOD  did  not  consistently  follow  OMB  reporting  requirements  to 
identify  root  causes  and  related  corrective  actions  and  the  underlying 
documentation  of  the  reported  corrective  actions  lacked  details  as  to  the 
corrective  actions  taken  or  planned  and  the  corresponding  results,  if  any. 
Second,  because  of  the  inherent  responsibility  to  be  a  good  steward  for 
public  resources,  it  is  important  that  corrective  actions  and  the 
effectiveness  of  such  be  openly  communicated  or  available  not  only  to  the 
Congress  and  agency  management  but  also  to  the  general  public. 

Balancing  the  benefits  of  summarizing  information  with  reporting 
compliance  and  user  needs  is  critical.  Corrective  actions  cannot  be 
effectively  monitored  and  assessed  unless  the  detailed  corrective  actions 
are  known  and  tied  to  the  root  cause(s)  of  improper  payments  that  they 
are  intended  to  address. 


DOD’s  Processes  To 
Address  Recovery  Auditing 
Act  Requirements 


We  made  five  recommendations  aimed  at  strengthening  DOD’s  recovery 
audit  processes  related  to  establishing  and  implementing  processes 
specifically  designed  to  identify  and  recover  commercial  payments, 
developing  detailed  guidance  to  carry  out  recovery  audits  and  activities, 
identifying  costs  related  to  its  recovery  auditing  program,  implementing  a 
process  to  identify  and  report  vendor  overpayments  and  associated 
recovered  amounts,  and  maintaining  documentation  to  support  reported 
amounts.  DOD  concurred  with  our  recommendation  to  identify  the  cost 
related  to  its  recovery  audit  program.  DOD  disagreed  with  the  other  four 
recovery  auditing  recommendations  because  it  believed  the  agency  had 
already  established  and  implemented  such  processes. 


However,  as  we  point  out  in  this  report,  the  majority  of  DOD’s  processes 
aimed  at  identifying  and  recovering  improper  payments  were  inadequate 
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because  the  primary  purpose  of  these  processes  were  not  to  identify 
commercial  improper  payments  as  required  by  the  Recovery  Auditing  Act. 
For  example,  DCMA  and  DCAA’s  contract  closeout  processes  were 
designed  to  ensure  that  applicable  administrative  actions  had  been 
completed  during  the  course  of  a  contract  (e.g.,  all  classified  documents 
were  disposed  of)  and  not  to  specifically  identify  contract  overpayments. 
In  addition,  DOD’s  current  FMR  guidance  (dated  December  2005)  did  not 
include  specific  elements  that  would  be  necessary  to  effectively  carry  out 
a  recovery  auditing  program.  Further,  DOD  had  not  established  a  process 
to  fully  identify  and  report  vendor  overpayments.  This  problem  continued 
to  exist  as  DOD  acknowledged  in  its  fiscal  year  2008  AFR  that  while  it  was 
able  to  identify  DOD-identified  overpayments  for  its  DFAS  component,  it 
was  unable  to  identify  and  report  vendor  overpayments  for  all  of  its 
components  and  that  efforts  would  continue  until  all  DOD  components 
achieved  this  capability. 


DOD’s  Oversight  and 
Monitoring  Efforts  To 
Address  IPIA  and 
Recovery  Auditing  Act 
Requirements 


DOD  disagreed  with  our  two  recommendations  related  to  oversight  and 
monitoring  and  commented  that  they  were  duplicative,  except  for  the 
additional  language  related  to  documenting  the  roles  and  responsibilities 
of  the  Recovery  Auditing  Project  Officer.  We  clarified  our 
recommendations  related  to  oversight  and  monitoring  to  emphasize  the 
need  of  these  activities  for  both  IPIA  and  the  Recovery  Auditing  Act.  As  we 
stated  in  our  report,  the  DOD  Office  of  the  Comptroller’s  oversight  and 
monitoring  of  improper  payment  and  recovery  auditing  activities  were 
inadequate  as  the  office  did  not  verify  the  accuracy  and  completeness  of 
information  received  from  DOD  agencies  and  military  service  components 
and  reported  in  its  AFR. 


We  are  sending  copies  of  this  report  to  interested  congressional 
committees;  the  Secretary  of  Defense;  and  the  Director,  Office  of 
Management  and  Budget.  In  addition,  this  report  will  be  available  at  no 
charge  on  the  GAO  Web  site  at  http://www.gao.gov. 
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If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me 
at  (202)  512-9095  or  by  e-mail  at  dalykl@gao.gov.  Contact  points  for  our 
Offices  of  Congressional  Relations  and  Public  Affairs  may  be  found  on  the 
last  page  of  this  report.  GAO  staff  who  made  major  contributions  to  this 
report  are  listed  in  appendix  V. 


Kay  L.  Daly,  Director 

Financial  Management  and  Assurance 
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Appendix  I:  Objectives,  Scope  and 
Methodology 


The  objectives  of  this  report  were  to  determine  whether  the  Department  of 
Defense  (DOD)  had  adequate  controls  in  place  to  address  the  Improper 
Payments  Information  Act  (IPIA)  and  the  Recovery  Auditing  Act 
requirements. 1  To  determine  whether  DOD  adequately  addressed  IPIA 
requirements,  we  reviewed  the  applicable  legislation  and  related  OMB 
implementing  guidance.2  We  further  reviewed  DOD’s  agency  financial 
reports  (AFR)  for  fiscal  years  2004  through  2008,  internal  DOD  improper 
payment  guidance,3  and  prior  GAO4  and  DOD  Office  of  Inspector  General 
(DOD  OIG)  reports5  on  improper  payments.  We  reviewed  these  documents 
to  understand  DOD’s  efforts  to  address  IPIA  requirements  and  to  identify 
previously  reported  issues  with  DOD’s  improper  payment  reporting.  In 
addition,  we  performed  the  following  work: 

•  To  assess  DOD’s  IPIA  risk  assessment  process  to  identify  payment 
activities  susceptible  to  significant  improper  payments,  we  reviewed 
our  Standards  for  Internal  Control  in  the  Federal  Government  and 
executive  guide  on  Strategies  to  Manage  Improper  Payments: 
Learning  from  Public  and  Private  Sector  Organizations  as  guidance 
to  assess  DOD’s  internal  controls  over  disbursements.  We  interviewed 
agency  officials  such  as  the  Project  Officer  for  Improper  Payment  and 


‘Pub.  L.  No.  107-300,  116  Stat.  2350  (Nov.  26,  2002);  and  National  Defense  Authorization  Act 
for  Fiscal  Year  2002,  Pub.  L.  No.  107-107,  div.  A,  title  VIII,  §  831,  115  Stat.  1012,  1186  (Dec. 

28,  2001),  codified  at  31  U.S.C.  §§  3561-3567. 

‘Appendix  C  to  OMB  Circular  No.  A-123,  Requirements  for  Effective  Measurement  and 
Remediation  of  Improper  Payments  (Aug.  10,  2006). 

3DOD’s  Financial  Management  Regulation  (FMR)  Volume  4,  Chapter  14,  Improper 
Payments. 

4GAO,  DOD  Travel  Cards:  Control  Weaknesses  Led  to  Millions  in  Fraud  ,  Waste,  and 
Improper  Payments,  GAO-04-825T  (Washington,  D.C.:  June  9,  2004);  Financial 
Management:  Challenges  in  Meeting  the  Requirements  of  the  Improper  Payments 
Information  Act,  GAO-05-417  (Washington,  D.C.:  Mar.  31,  2005);  Improper  Payments: 
Agencies’  Fiscal  Year  2005  Reporting  Under  the  Improper  Payments  Information  Act 
Remains  Incomplete,  GAO-07-92  (Washington,  D.C.:  Nov.  14,  2006);  Improper  Payments: 
Incomplete  Reporting  under  the  Improper  Payments  Information  Act  Masks  the  Extent  of 
the  Problem,  GAO-07-254T  (Washington,  D.C.:  Dec.  5,  2006);  Improper  Payments: 

Agencies’  Efforts  to  Address  Improper  Payments  and  Recovery  Auditing  Requirements 
Continue,  GAO-07-635T  (Washington,  D.C.:  Mar.  29,  2007);  and  Improper  Payments:  Status 
of  Agencies  ’  Efforts  to  Address  Improper  Payment  and  Recovery  Auditing  Requirements, 
GAO-08-438T  (Washington,  D.C.:  Jan.  31,  2008). 

“DOD  OIG  Reports,  Identification  and  Reporting  of  DOD  Erroneous  Payments,  D-2005- 
100  (Aug.  17,  2005);  Identification  and  Reporting  of  Improper  Payments  through 
Recovery  Auditing,  D-2007-110  (July  9,  2007);  and  Identification  and  Reporting  of 
Improper  Payments  by  the  Defense  Logistics  Agency,  D-2008-096  (May  20,  2008). 
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Recovery  Auditing,  and  obtained  and  reviewed  fiscal  year  2007 IPLA 
responses,  where  available.  We  also  compared  the  amounts  reported 
as  the  basis  for  improper  payments  to  other  documentation  such  as  the 
President’s  Budget  and  Statement  of  Budgetary  Resources  to 
determine  whether  all  DOD  outlays  were  subject  to  improper  payment 
assessments. 

•  To  assess  the  statistical  validity  of  DOD’s  reported  improper  payment 
estimates  for  fiscal  year  2007,  we  conducted  an  independent  analysis 
of  its  sampling  methodologies,  including  a  review  of  the  sampling 
plans  for  each  DOD  agency  and  military  service  component.  In 
addition,  we  performed  an  independent  assessment  of  DOD’s  IPLA 
processes,  including  a  legal  analysis  of  the  improper  payment 
definition  in  relation  to  DOD’s  classification  of  commercial  payment 
errors  (contract  and  vendor  payments)  as  either  improper  or  proper  to 
determine  whether  DOD  had  reached  appropriate  conclusions.  In 
addition,  we  interviewed  the  IPLA  Project  Officer,  Defense  Finance 
Accounting  Service  (DFAS)-Kansas  City,  and  DFAS-Columbus 
officials,  to  identify,  estimate,  and  reduce  improper  payments  and 
reviewed  supporting  documentation,  when  available,  in  order  to  gain 
an  understanding  of  DOD’s  IPIA  process.  We  also  interviewed  DOD 
OIG  officials  to  discuss  their  findings  and  recommendations  related  to 
DOD’s  efforts  to  address  IPLA  requirements. 

•  To  assess  DOD’s  corrective  action  plans  to  reduce  improper  payments, 
we  interviewed  agency  officials,  reviewed  corrective  actions  to  reduce 
improper  payments,  and  reviewed  corrective  action  plans  to  determine 
whether  appropriate  linkages  existed  between  the  root  causes  of 
improper  payments  and  specific  corrective  action  steps.  We  also 
performed  an  analysis  of  DOD’s  improper  payment  error  rates  to 
determine  whether  the  improper  payment  error  rates  for  DOD 
payment  activities  had  changed  from  fiscal  year  to  fiscal  year. 

•  To  assess  the  accuracy  and  completeness  of  DOD’s  reported  fiscal 
year  2007  improper  payment  amounts,  we  recalculated  summary 
amounts  included  on  DOD’s  IPLA  survey  and  traced  those  amounts  to 
supporting  documentation. 

To  determine  whether  DOD  had  adequately  addressed  the  Recovery 

Auditing  Act  requirements,  we  reviewed  applicable  legislation  and  related 

OMB  implementing  guidance,6  DOD’s  AFR  for  fiscal  years  2004  through 


6See  Appendix  C  to  OMB  Circular  No.  A-123,  pt.  II. 
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2008,  internal  DOD  recovery  auditing  guidance, '  and  prior  GAO8  and  DOD 
OIG  reports9  on  recovery  auditing.  We  interviewed  agency  officials  such  as 
the  Recovery  Auditing  Project  Officer,  the  Director  of  Internal  Review,  and 
the  Chief  of  DFAS’s  Debt  Management  Office  regarding  DOD’s  process  to 
identify  and  recover  commercial  overpayments  and  reviewed 
accompanying  and  supporting  documentation,  when  available. 

We  also  interviewed  Defense  Contract  Audit  Agency  (DCAA)  and  Defense 
Contract  Management  Agency  (DCMA)  officials  such  as  the  DCAA 
Headquarters  Program  Manager  of  the  Policy  Programs  Division  and 
DMCA  contract  specialists  to  determine  their  role  in  DOD’s  recovery 
auditing  process  and  reviewed  applicable  guidance. 10  Further,  we 
interviewed  DOD  OIG  officials  such  as  the  DOD  OIG  Program  Director 
and  the  Audit  Project  Manager  at  DFAS-Columbus  to  discuss  their  findings 
and  recommendations  related  to  DOD’s  efforts  to  address  recovery 
auditing  requirements.  Also,  we  interviewed  Department  of  the  Navy 
officials  regarding  results  of  the  recovery  audit  performed  to  identify 
overpayments  made  in  its  telecommunications  program.  In  addition,  we 
interviewed  TRICARE  Management  Activity  (TMA)  officials  to  obtain 
clarification  and  supporting  documentation  on  the  healthcare-recovered 
amounts  reported  in  DOD’s  AFR.  To  assess  the  accuracy  and 
completeness  of  DOD’s  reported  fiscal  year  2007  recoveiy  audit 
information,  we  reviewed  DFAS  and  TMA  supporting  documentation 
submitted  to  the  Office  of  the  Comptroller  to  substantiate  amounts 
reported  in  the  AFR.  We  traced  these  schedules  and  total  amounts 
submitted  to  the  Office  of  the  Comptroller  back  to  various  supporting 
breakdowns  (at  the  transaction  level).  In  addition,  we  recalculated  and 


DOD  FMR,  Volume  5,  Chapter  1  and  Volume  10,  Chapters  1,  18,  20,  and  22. 

sGAO,  Contract  Management:  Recovery  Auditing  Offers  Potential  to  Iden  tify 
Overpayments,  GAO/NSIAD-  99-12  (Washington,  D.C.:  Dec.  3,  1998);  Contract 
Management:  DOD  is  Examining  Opportunities  to  further  Use  Recovery  Auditing, 
GAO/NSIAD-  99-78  (Washington,  D.C.:  Mar.  17,  1999);  Recovery  Auditing:  Reducing 
Overpayments,  Achieving  Accountability,  and  the  Government  Waste  Corrections  Act  of 
1999,  GAO/T-NSIAD-99-213  (Washington,  D.C.:  June  29,  1999);  and  Contract  Management: 
DOD  Could  Benefit  From  the  Use  of  Internal  Recovery  Auditing,  GAO/NSIAD-00-66R 
(Washington,  D.C.:  Mar.  10,  2000). 

9DOD  OIG,  Financial  Management:  DOD  Recovery  Audit  Program,  D-2005-101  (Aug.  17, 
2005);  Identification  and  Reporting  of  Improper  Payments  Through  Recovery  Auditing, 
D-2007-110  (July  9,  2007). 

“DCAA  Contract  Audit  Manual  chapter  6  and  DCMA  Guidebook  Contract  Closeout. 


Page  36 


GAO-09-442  DOD  Improper  Payments 


Appendix  I:  Objectives,  Scope  and 
Methodology 


verified  the  accuracy  of  the  recovery  audit  amounts  in  DOD’s  summary 
recovery  auditing  table. 

We  conducted  site  visits  at  two  of  the  five  DFAS  processing  center 
locations  (Kansas  City,  Missouri  and  Columbus,  Ohio).  We  selected  the 
DFAS-Kansas  City  site  because  it  was  responsible  for  receiving  IPIA 
survey  information  from  other  DFAS  sites,  compiling  the  information,  and 
checking  the  information  for  accuracy  and  completeness.  As  part  of  this 
site  visit,  we  obtained  an  understanding  of  DFAS’s  process  for  conducting 
monthly  postpayment  reviews  of  military  and  civilian  pay  to  identify 
improper  payments.  In  addition,  we  selected  the  DFAS-Columbus  site 
because  it  processed  a  majority  of  DOD’s  commercial  payments — the 
agency’s  largest  payment  activity — on  behalf  of  the  DOD  agencies  and 
military  services.  Also,  DFAS-Columbus  was  the  only  DFAS  site  that 
processed  DOD  contract  payments.  At  the  DFAS-Columbus  site,  we 
obtained  an  understanding  of  the  commercial  prepayment  and 
postpayment  controls  in  place  affecting  IPIA  and  Recovery  auditing 
requirements. 

To  determine  the  reliability  of  DOD’s  improper  payment  and  recovery 
audit  information,  we  interviewed  knowledgeable  agency  officials,  such  as 
the  DFAS-Indianapolis  Director  of  Accounts  Payable  and  DFAS- 
Indianapolis  Accounts  Receivable  specialists,  to  ascertain  the  procedures 
used  to  assume  the  quality  of  the  data.  We  reviewed  DOD’s  commercial 
payment  activity  from  its  contract  and  vendor  pay  systems  and  its 
Improper  Payments  Online  Database  (IPOD)  that  stored  the  improper 
payment  information.  We  also  traced  data  back  to  supporting 
documentation,  including  DOD’s  fiscal  year  2007  IPIA  survey,  the  AFR, 
and  the  recovery  auditing  activity  schedule.  We  performed  a  data 
reliability  assessment  of  DOD’s  statistical  sampling  methodologies  for  the 
fiscal  year  2007  reported  improper  payment  estimates,  (see  appendix  III). 
We  concluded  that  the  data  were  reliable  for  our  purposes. 

We  conducted  our  audit  work  from  June  2008  to  June  2009  in  accordance 
with  generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate 
evidence  to  provide  a  reasonable  basis  for  our  findings  and  conclusions, 
based  on  our  audit  objectives.  We  believe  that  the  evidence  obtained 
provides  a  reasonable  basis  for  our  findings  and  conclusions  based  on  our 
audit  objectives.  We  obtained  written  comments  on  a  draft  of  this  report 
from  the  Under  Secretary  of  Defense  (Comptroller)  and  have  summarized 
these  comments  in  the  Agency  Comments  and  Our  Evaluation  section  of 
this  report. 
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1.  Department  of  the  Army 

2.  Department  of  the  Navy 

3.  Department  of  the  Air  Force 

4.  United  States  Marine  Corps,  Assistant  Deputy  Commandant  for 
Programs  and  Resources 

5.  Inspector  General  of  the  Department  of  Defense 

6.  Defense  Advanced  Research  Projects 

7.  Defense  Contract  Audit  Agency 

8.  Defense  Finance  and  Accounting  Service 

9.  Defense  Intelligence  Agency 

10.  Defense  Logistics  Agency 

11.  Defense  Security  Service 

12.  Missile  Defense  Agency 

13.  National  Security  Agency/Central  Security  Service 

14.  Defense  Commissary  Agency 

15.  Defense  Contract  Management  Agency 

16.  Defense  Information  Systems  Agency 

17.  Defense  Legal  Services  Agency 

18.  Defense  Security  Cooperation  Agency 

19.  Defense  Threat  Reduction  Agency 

20.  Pentagon  Force  Protection  Agency 

21.  National  Geospatial  Intelligence  Agency 

22.  United  States  Army  Corps  of  Engineers 

23.  American  Forces  Information  Services 

24.  Defense  Technology  Security  Administration 

25.  Department  of  Defense  Education  Activity 

26.  Department  of  Defense  Test  Resource  Management  Center 

27.  Defense  Technical  Information  Center 

28.  Defense  Prisoner  of  War/Missing  Personnel  Office 

29.  Department  of  Defense  Counterintelligence  Field  Activity 

30.  Defense  Human  Resources  Activity 

31.  Office  of  Economic  Adjustment 

32.  TRICARE  Management  Activity 

33.  Washington  Headquarters  Services 
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In  its  fiscal  year  2007  Agency  Financial  Report  (AFR),  the  Department  of 
Defense  (DOD)  reported  on  five  payment  activities  as  part  of  its  Improper 
Payments  Information  Act  (IPLA)  reporting:  military  pay,  military  health 
benefits,  civilian  pay,  military  retirement,  and  travel  pay.  The  information 
reported  in  DOD’s  AFR  is  compiled  from  the  IPIA  survey  submitted  by  the 
DOD  agencies  and  military  services.  DOD  agencies  and  military  services 
used  related  confidence  levels  over  different  ranges  (generally,  as 
prescribed  in  OMB  guidance)  to  plan  and  estimate  improper  payment 
amounts  reported  in  DOD’s  fiscal  year  2007  AFR.  We  reviewed  the  sample 
plans  for  each  of  the  five  payment  activities,  at  the  component  level,  and 
determined  those  methodologies  generally  complied  with  the  Office  of 
Management  and  Budget’s  (OMB)  implementing  guidance. 1 

OMB  guidance  requires  that  applicable  agencies  estimate  the  gross  total  of 
both  over-  and  underpayments  for  those  programs  and  activities  identified 
as  susceptible  to  significant  improper  payments.2  OMB  also  requires  that 
the  estimates  be  based  on  a  statistically  valid  random  sample  of  sufficient 
size  to  yield  an  estimate  with  a  90  percent  confidence  interval  of  plus  or 
minus  2.5  percentage  points  around  the  estimate  of  the  percentage  of 
improper  payments.  Alternatively,  agencies  may  use  a  95  percent 
confidence  interval  of  plus  or  minus  3.0  percentage  points  around  the 
estimate  of  the  percentage  of  improper  payments  to  estimate  improper 
payments  for  agency  programs.  If  an  agency  cannot  determine  whether  a 
payment  was  proper  because  of  insufficient  documentation,  OMB 
guidance  requires  that  the  payment  be  considered  an  error.  A  brief 
description  of  each  payment  activity’s  methodology  reported  in  its 
sampling  plan  is  provided  below. 


1.  Military  Health 
Benefits  Program 


The  military  health  benefits  program  consists  of  disbursements  for  the 
medical  care  of  active  duty  military  personnel,  retirees,  their  family 
members,  and  family  members  of  deceased  service  members.  TRICARE 
Management  Activity  (TMA)  processed  all  military  health  benefit 
payments  for  DOD.  To  estimate  military  health  benefits  improper 
payments,  TMA  selected  samples  from  the  two  populations  of  its  contract 


‘For  military  health  benefits,  its  sample  of  denied  claims  used  a  confidence  level  of  80 
percent,  which  was  not  in  accordance  with  OMB  guidance.  However,  we  determined  that 
this  deviation  was  immaterial. 

“Appendix  C  to  OMB  Circular  No.  A-123,  Requirements  for  Effective  Measurement  and 
Remediation  of  Improper  Payments  (Aug.  10,  2006). 
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payments,  as  shown  in  table  4  below.  The  contract  samples  were  drawn  on 
a  quarterly  basis  and  stratified  by  dollar  value.  For  both  contract  types 
sampled,  denied  payment  samples  were  based  on  the  amount  billed  and 
nondenied  payment  samples  were  based  on  government  costs. 


Table  4:  Military  Health  Benefits  Program  Sample  Plans 


Components 

Annual  universe  of  payments 
(Population) 

Annual  payment  sample  size 

Confidence  interval 

TRICARE  Next  Generation  Managed 
Care  Support  Contracts 

Nondenied  claims  valued  at  $100  to 
$100k:  9,481  claims 

Nondenied  claims:  90%+/- 1% 

15,433,902 

1 00%  review  of 

Nondenied  claims  greater  than 
$1 00k:  1,750  claims 

Not  applicable 

TRICARE 

management 

activity 

Denied  claims  valued  at  $100  to 
$1 00k:  3,055  claims 

Denied  claims:  80%  +/-2% 

1 00%  review  of 

denied  claims  greater  than  $1 00k: 

885  claims 

Not  applicable 

TRICARE  Dual  Eligibility  Fiscal 
Intermediary  Contract 

Nondenied  claims  valued  at  $1  to 
$25k:  4,737  claims 

Nondenied  claims:  90%+/- 1% 

44,607,708 

1 00%  review  of 

Nondenied  claims  greater  than  $25k: 

1 ,463  claims 

Not  applicable 

Denied  claims  valued  at  $1  to  $500k: 

1 ,557  claims 

Denied  claims:  80%  +/-2% 

1 00%  review  of 

denied  claims  greater  than  $500k: 

385  claims 

Not  applicable 

Source:  GAO’s  analysis  of  DOD’s  sampling  plans. 


2.  Military  Pay 
Program 


The  military  pay  program  consists  of  military  payroll  disbursements.  The 
Defense  Finance  and  Accounting  Services  (DFAS)  processed  all  military 
payroll  payments  for  DOD.  To  estimate  improper  payments,  DFAS-Kansas 
City  conducted  monthly  postpayment  reviews  to  determine  the  accuracy 
of  net  military  pay  using  a  simple  random  attribute  sample  and  summed 
monthly  results  to  calculate  an  annual  estimate.  In  addition  to  its 
statistical  sample,  the  military  pay  program’s  estimate  of  improper 
payments  included  actual  data  on  improper  payment  amounts.  Table  5 
shows  information  reported  in  the  sampling  plan  for  military  pay. 
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Table  5:  Military  Pay  Program  Sample  Plans 

Components 

Annual  universe  of 
payments  (Population) 

Annual  payment 
sample  size 

Confidence 

interval 

DFAS 

Active  Duty:  17,034,781 

7,400 

Reserve  &  Guard:  5,062,463 

13,400 

95%  +/-  2.5% 

Source:  GAO'S  analysis  of  DOD's  sampling  plans. 


3.  Civilian  Pay 
Program 


The  civilian  pay  program  consists  of  civilian  payroll  disbursements.  DFAS, 
Army,  and  Navy  processed  civilian  payments  in  fiscal  year  2007.  DFAS- 
Kansas  City  conducted  monthly  postpayment  reviews  to  determine  the 
accuracy  of  net  pay  using  simple  random  attribute  samples.  In  addition  to 
monthly  samples,  DFAS  added  actual  improper  payment  data  to  further 
enhance  its  estimate.  DFAS  monthly  results  were  summed  to  calculate  the 
annual  estimate.  Army’s  sample  plan  consisted  of  annual  postpayment 
reviews  and  analysis  of  a  sample  of  disbursements,  and  Navy’s  sample 
plan  consisted  of  a  statistical  sample  of  Military  Sealift  Command  Civilian 
Mariners  payments.  Table  6  shows  detailed  sampling  plans  for  each 
component  of  the  civilian  pay  program. 


Table  6:  Civilian  Pay  Program  Sample  Plans 

Components 

Annual  universe  of 
payments  (Population) 

Annual  payment 
sample  size 

Confidence 

interval 

DFAS 

7,655,277 

6,350 

95%  +/-  2.5% 

Army 

15,128 

15,128 

n/a 

Navy 

$404,522,148 

$404,522,148 

n/a 

Source:  GAO’s  analysis  of  DOD’s  sampling  plans. 


4.  Military  Retirement 
Program 


The  military  retirement  program  consists  of  disbursements  to  military 
retirees  and  annuitants.  DFAS  processed  all  military  retirement  payments 
for  DOD.  DFAS-Cleveland  performed  monthly  postpayment  reviews  to 
determine  the  accuracy  of  payments  using  simple  random  samples.  Three 
samples  were  conducted  to  assess  the  accuracy  of  payments — one  for 
deceased  retirees,  the  other  for  retired  accounts,  and  the  third  for 
annuitant  accounts,  as  shown  in  table  7.  The  deceased  retirees  sample  is 
designed  to  identify  retiree  payments  going  to  deceased  individuals,  while 
the  retired  and  annuitant  samples  identify  whether  regular  payments  are 
accurate. 
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Table  7:  Military  Retirement  Program  Sample  Plans 


Annual  universe  Annual  payment  Confidence 
Components  of  payments  (Population)  sample  size  interval 

Deceased  retiree  account  1 ,656  90%  +/-  2.5% 

postpayment  reviews:  40,392 

DFAS  Retired  account  postpayment  3,000  95%  +/-  2.5% 

reviews:  2,004,706 

Annuitant  account  postpayment  3,000  95%  +/-  2.5% 

reviews:  288,749 


Source:  GAO’s  analysis  of  DOD’s  sampling  plans. 


5.  Travel  Pay  Program 


The  following  components  processed  travel  payments:  DFAS,  Army,  Navy, 

and  Air  Force.  Table  8  shows  detailed  sample  plans  for  each  component  of 
the  travel  pay  program.  DFAS-Indianapolis  conducted  random  monthly 
reviews  to  determine  accuracy  of  payments  and  summed  monthly  results 
to  arrive  at  an  annual  sample.* * 3  Army  travel  pay  consisted  of  Army  Korea,4 
Army  Europe,  and  the  Army  Corps  of  Engineers.  Army  Europe  and  Army 
Corps  of  Engineers  components  conducted  monthly  postpayment  reviews 
of  travel  payments.  Army  Korea  did  not  provide  sampling  results.  Navy 
conducted  a  statistical  sample  of  travel  payments  processed  through  its 
system.  Air  Force  conducted  post  audit  reviews  of  a  random  sample  of 
travel  payments. 


3For  its  other  travel  payment  system,  the  Integrated  Automated  Travel  System,  DFAS 
performed  a  duplicate  payment  review  for  fiscal  year  2007.  We  previously  reported  that 
these  duplicate  reviews  cannot  be  used  to  estimate  the  value  of  improper  payments  to  the 
entire  population.  DOD  agreed  with  our  recommendation  to  establish  and  implement 
procedures  to  report  a  valid  improper  payment  estimate  for  the  population.  See  GAO,  DOD 
Travel  Improper  Payments:  Fiscal  Year  2006  Reporting  Was  Incomplete  and  Planned 
Improvement  Efforts  Face  Challenges,  GAO-08-16  (Washington,  D.C.:  Dec.  14,  2007).  We 
determined  for  fiscal  year  2008  that  DFAS  had  developed  a  statistically  valid  methodology 
to  estimate  its  travel  improper  payments. 

4Army  Korea  did  not  submit  its  IPIA  Survey  response  in  time  to  be  included  in  the  fiscal 
year  2007  AFR. 
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Table  8:  Travel  Pay  Program  Sample  Plans 

Components 

Annual  universe  of 
payments  (Population) 

Annual 

payment  sample  size 

Confidence 

interval 

DFAS 

2,251,075 

43,635 

95%  +/-  2.5% 

Army 

Army  Europe:  80,816 

10%  of  all  vouchers:  8,081 
&  1 00%  of  vouchers  over 
$2,500:  8,331 

99%  +/-  1 .0% 

Corps  of  Engineers: 

165,643 

Corps  of  Engineers:  452 

95%  +/-  2.0% 

Navy 

$651,374,570 

$565,218,446 

90%  +/-  1 .4% 

Air  Force 

1,211,307 

186 

90% 

Source:  GAO’s  analysis  of  DOD’s  sampling  plans. 
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UNDER  SECRETARY  OF  DEFENSE 
1  lOO  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-1 1 0O 

COMPTROLLER 

l  UN  2  9  2009 

Ms.  Kay  L.  Daly 

Director,  Financial  Management  and  Assurance 
Government  Accountability  Office 
441  G  Street,  N.W. 

Washington,  DC  20548 

Dear  Ms.  Daly, 

This  is  the  Department  of  Defense  (DoD)  response  to  the  Government 
Accountability  Office  (GAO)  draft  report,  “ Improper  Payments :  Significant 
Improvements  Needed  in  DoD  ’s  Efforts  to  Address  Improper  Payment  and  Recovery 
Auditing  Requirements dated  June  4, 2009  (GAO  Code  1 95 1 40). 

The  Department  concurs  with  one  of  the  recommendations  in  the  draft  report  and 
corrective  action  will  be  implemented  for  FY  2010  reporting.  The  Department  does  not 
concur  with  the  remaining  recommendations  and  our  response  is  attached. 

My  point  of  contact  on  this  matter  is  Ms.  Sally  Beecroft.  She  may  be  reached  by 
email  at  sally.beecroft@osd.mil  or  telephone  at  (703)  602-0193. 

Robert  F.  Hale 

Attachment: 

As  stated 
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GAO  DRAFT  REPORT  DATED  JUNE  2009 
GAO-09-442  (GAO  CODE  195140,  FORMERLY  195113) 

“IMPROPER  PAYMENTS:  SIGNIFICANT  IMPROVEMENTS  NEEDED  IN 
DOD’S  EFFORTS  TO  ADDRESS  IMPROPER  PAYMENT  AND 
RECOVERY  AUDITING  REQUIREMENTS” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  RECOMMENDATIONS 


RECOMMENDATION  1:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  establish  and  implement  a  systematic  approach,  as  a  part  of  the 
risk  assessment  process,  to  ensure  all  programs  and  activities  are  reviewed  to  determine 
susceptibility  to  improper  payments,  (Page  36/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  The  Department  established  IPIA  program  baselines, 
and  measures  and  reports  on  all  of  its  IPIA  programs  annually  in  accordance  with  OMB 
guidance.  Risk  assessments  are  required  for  programs  that  are  not  being  reported  in  order 
to  make  a  determination  whether  or  not  the  program  is  at  risk  for  significant  improper 
payments  and  initiate/resume  reporting;  or  a  significant  event  has  occurred  that  requires 
program  reevaluation.  The  OMB  Circular  A-123,  Appendix  C  guidance  states, 

“Agencies  need  not  conduct  formal  risk  assessments  for  those  programs  in  which 
improper  payment  baselines  are  already  established,  are  in  the  process  of  being  measured, 
or  will  be  measured  by  an  established  date.” 

RECOMMENDATION  2:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  develop  and  implement  detailed  guidance  for  conducting  risk 
assessments,  including  the  steps  to  determine  if  risk  exists,  what  those  risks  are,  and  the 
potential  or  actual  impact  of  those  risks  on  program  operations.  (Page  36/GAO  Draft 
Report) 

DOD  RESPONSE:  Nonconcur.  The  Department  established  IPIA  program  baselines, 
and  measures  and  reports  on  all  of  its  IPIA  programs  annually  in  accordance  with  OMB 
guidance.  Risk  assessments  are  required  for  programs  that  are  not  being  reported  in  order 
to  make  a  determination  whether  or  not  the  program  is  at  risk  for  significant  improper 
payments  and  initiate/resume  reporting;  or  a  significant  event  has  occurred  that  requires 
program  reevaluation.  The  OMB  Circular  A-123,  Appendix  C  guidance  states, 

“Agencies  need  not  conduct  formal  risk  assessments  for  those  programs  in  which 
improper  payment  baselines  are  already  established,  are  in  the  process  of  being  measured, 
or  will  be  measured  by  an  established  date. 

RECOMMENDATION  3:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  require  DoD  agencies  and  the  military  services  to  document  the 


Attachment 
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risk  assessment  methodology  used,  including  the  risk  factors  considered,  and  the  rationale 
for  assessing  the  risk  level  for  the  payment  activity.  (Page  36/GAO  Draft  Report) 

POD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  established  IPIA  program  baselines,  and  measures 
and  reports  on  all  of  its  IPIA  programs  annually  in  accordance  with  OMB  guidance.  Risk 
assessments  are  required  for  programs  that  are  not  being  reported  in  order  to  make  a 
determination  whether  or  not  the  program  is  at  risk  for  significant  improper  payments  and 
initiate/resume  reporting;  or  a  significant  event  has  occurred  that  requires  program 
reevaluation.  The  OMB  Circular  A-123,  Appendix  C  guidance  states,  “Agencies  need 
not  conduct  formal  risk  assessments  for  those  programs  in  which  improper  payment 
baselines  are  already  established,  are  in  the  process  of  being  measured,  or  will  be 
measured  by  an  established  date. 

RECOMMENDATION  4:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  develop  and  implement  a  statistically  valid  methodology  to 
estimate  and  report  commercial  improper  payments  (contract  and  vendor  over-  and  under¬ 
payments).  (Page  36/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  The  Department  followed  guidance  provided  by  OMB 
for  reporting  commercial  payments.  Commercial  improper  payments  are  to  be  identified, 
recovered  and  reported  in  accordance  with  the  Recovery  Auditing  Act  (Section  831  of 
Public  Law  107-107)  and  in  accordance  with  OMB  Circular  A-123,  Appendix  C,  Part  II. 
Neither  the  law  nor  the  regulation  require  or  suggest  statistical  sampling  for  this  category 
of  payments.  Recovery  auditing  allows  for  full  recovery  of  any  identified  and 
substantiated  improper  payments.  Statistical  sampling  only  allows  for  recovery  of 
improper  payments  identified  in  the  sample  population  and  it  is  impossible  to  recover 
from  an  extrapolation  of  the  sample  population.  It  omits  the  balance  of  possible  improper 
payments  that  were  not  a  part  of  the  sample,  thus  precluding  recovery  of  a  great  deal  more 
of  taxpayer  funds. 

RECOMMENDATION  5:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  identify  and  fully  disclose  the  root  causes  of  improper  payments 
annually  in  the  Agency’s  Financial  Report  (AFR).  (Page  36/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  We  do  not  agree  that  the  AFR  is  the  appropriate  forum 
for  detail  level  information.  The  Department  documents  the  root  causes  of  improper 
payments,  publishes  summary  level  information  annually  in  the  AFR,  and  detail  level 
information  is  more  appropriately  provided  to  the  Component  responsible  for  corrective 
action. 

RECOMMENDATION  6:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  identify  and  fully  disclose  the  corrective  actions,  and  monitor  the 
corrective  actions  to  ensure  that  they  address  applicable  root  causes.  (Page  36/GAO  Draft 
Report) 
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POD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  has  procedures  in  place  to  identify,  fully  disclose, 
and  monitor  corrective  actions  to  ensure  these  actions  address  applicable  root  causes  of 
improper  payments. 

RECOMMENDATION  7:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  perform  oversight  and  monitoring  activities  to  ensure  the 
accuracy  and  completeness  of  the  data  submitted  by  the  DoD  agencies  and  the  military 
services  for  inclusion  in  the  AFR.  (Page  36/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Accounting  and  Finance  Policy  Directorate  performs  oversight 
and  monitoring  activities  to  ensure  the  accuracy  and  completeness  of  the  data  submitted 
by  DoD  Components  for  inclusion  in  the  AFR. 

RECOMMENDATION  8:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  establish  and  implement  processes  specifically  designed  to 
identify  and  recover  commercial  overpayments.  (Page  37/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  has  established  and  implemented  processes 
specifically  designed  to  identify  and  recover  improper  commercial  payments. 

RECOMMENDATION  9:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  develop  and  implement  detailed  guidance  to  assist  DoD  agencies 
and  the  military  services  in  effectively  carrying  out  recovery  audits  and  activities, 
including  the  payment  and  accounting  systems  to  be  reviewed,  the  frequency  of  these 
reviews,  applicable  roles  and  responsibilities,  and  reporting  requirements.  (Page  37/GAO 
Draft  Report) 

DOD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  developed  and  published  the  Financial 
Management  Regulation  (FMR)  Volume  10,  Chapter  22,  “Recovery  Auditing,”  in 
December  2005  to  assist  DoD  Components  in  effectively  carrying  out  recovery  audits  and 
activities.  An  update  to  this  chapter  is  currently  in  Departmental  coordination.  We 
anticipate  that  the  updated  will  be  published  by  the  end  of  FY  2009  for  FY  20 1 0 
reporting. 

RECOMMENDATION  10:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  establish  and  implement  a  process  to  identify  costs  related  to  the 
department’s  recovery  auditing  program,  including  costs  for  employees’  salaries.  (Page 
37/GAO  Draft  Report) 
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POD  RESPONSE:  Concur.  The  Department  will  establish  and  implement  a  process  to 
identify  costs  related  to  the  Department’s  recovery  auditing  program,  including  costs  for 
employees’  salaries.  We  plan  to  begin  implementation  forFY  2010  reporting. 

RECOMMENDATION  1 1 :  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  establish  and  implement  a  process  to  identify  and  report  vendor 
overpayments  and  the  associated  recovered  amounts.  (Page  37/GAO  Draft  Report) 

DOD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  has  established  and  implemented  processes 
specifically  designed  to  identify  and  recover  commercial  (which  includes  vendor) 
overpayments  and  the  associated  recovered  amounts. 

RECOMMENDATION  12:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  maintain  documentation  to  support  the  amounts  reported  in  the 
AFR  to  allow  for  independent  evaluation  of  this  information.  (Page  37/GAO  Draft 
Report) 

DOD  RESPONSE:  Nonconcur.  Such  direction  is  not  necessary  because  it  is  already 
being  accomplished.  The  Department  maintains  documentation  to  support  the  amounts 
reported  in  the  AFR. 

RECOMMENDATION  13:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  DoD  Comptroller  to  perform  oversight  and  monitoring  activities  to  ensure  the 
accuracy  and  completeness  of  the  data  submitted  by  the  DoD  agencies  and  the  military 
services  for  inclusion  in  the  AFR.  Also,  document  the  roles  and  responsibilities  of  the 
Recovery  Auditing  Project  Officer.  (Page  37/GAO  Draft  Report) 

DOD  RESPONSE:  Recommendation  1 3  is  a  duplicate  of  7  except  for  the  last  sentence. 
Nonconcur  with  the  final  sentence.  The  roles  and  responsibilities  of  the  Recovery 
Auditing  Project  Officer  already  are  documented. 
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GAO’s  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and  policies; 
and  provides  analyses,  recommendations,  and  other  assistance  to  help 
Congress  make  informed  oversight,  policy,  and  funding  decisions.  GAO’s 
commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no  cost 
is  through  GAO’s  Web  site  (www.gao.gov).  Each  weekday  afternoon,  GAO 
posts  on  its  Web  site  newly  released  reports,  testimony,  and 
correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted  products, 
go  to  www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  information  is  posted  on  GAO’s  Web  site, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)  512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 

MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Web  site:  www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Ralph  Dawn,  Managing  Director,  dawnr@gao.gov,  (202)  512-4400 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125 
Washington,  DC  20548 

Public  Affairs 


Chuck  Young,  Managing  Director,  youngcl@gao.gov,  (202)  512-4800 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  DC  20548 
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